This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] OpenSSH fixes 5 vulnerabilities

OpenSSH version 10.3 [1] fixes 5 vulnerabilities [2][3][4][5][6]. The most severe of them is described below. Neither Debian nor Red Hat has provided fixes yet [7][8]. Gentoo has the fixed version 10.3_p1 available as a testing package [9].

OpenSSH - privilege escalation (CVE-2026-35414)
CVSS 8.1 (High)

An unauthenticated remote attacker with a valid certificate can, under certain conditions, gain unauthorized root access to the server. Using a comma in the certificate's subject name (e.g. 'deploy,root') causes the string to be split incorrectly, and the 'root' fragment is evaluated as a valid authorization. Exploitation is possible in configurations using the 'principals=' option in the 'authorized_keys' file if the certification authority allows issuing a certificate containing a comma [2][10][11]. Detailed information and a PoC for this vulnerability, named SplitSSHell, can be found at [10].

The vulnerability is present in product:

  • OpenSSH; <10.3;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 4. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 30. 4. 2026.

CESNET, z.s.p.o. Logo