Security Weakness in OpenSSH's sshd Server Configuration
CVE-2026-59999

5.9MEDIUM

Key Information:

Vendor

OpenBSD
Status
Openssh
Vendor
CVE Published:
8 July 2026

What is CVE-2026-59999?

A configuration issue exists in the sshd component of OpenSSH versions prior to 10.4, where the setting of 'DisableForwarding=yes' does not properly take precedence over 'PermitTunnel=yes'. This flaw can lead to unexpected behavior in SSH tunneling configurations, potentially allowing unauthorized port forwarding when it should be disabled. Users are advised to review their sshd configuration settings to ensure intended security policies are enforced.

Affected Version(s)

OpenSSH 0 < 10.4

References

https://www.openwall.com/lists/oss-security/2026/07/06/5
https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
https://www.openssh.org/releasenotes.html#10.4p1

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.