Improper Input Validation in Apache MINA SSHD's GitPgmCommandFactory

CVE-2026-58624

What is CVE-2026-58624?

A vulnerability exists in Apache MINA SSHD's GitPgmCommandFactory that allows authenticated users to execute arbitrary JGit commands on git repositories. This includes the potential for executing commands that can manipulate files on the server without proper restrictions. Although the GitPgmCommandFactory can be used to facilitate SSH access for executing git commands, if the server is not properly configured to limit the commands available, it poses a significant security risk. Recommended mitigation includes upgrading to Apache MINA SSHD version 2.19.0 or 3.0.0-M5, which implements a command whitelist to restrict operations and improve security.

References