CVE-2026-106583
published 2026-10-07CVE-2026-106583: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.15%
3.9th percentile
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.6 | 10.6 |
| openbsd | openssh | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| ubuntu | openssh | — | — |
| ubuntu | openssh-gssapi | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 6.5
CVE-2026-106553 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 6.5
CVE-2026-106552 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote
attacker controlling the server could possibly use this issue to write
files to unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous
failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Red Hat
openssh: openssh: Command injection via unvalidated command-line username
vendor_redhat·2026-10-06·CVSS 7.8
CVE-2026-106583 [HIGH] CWE-78 openssh: openssh: Command injection via unvalidated command-line username
openssh: openssh: Command injection via unvalidated command-line username
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through shell-evaluated options such as ProxyCommand, potentially leading to arbitrary command execution.
Statement: A low-impact command injection flaw was found in the OpenSSH client. The ssh client did not restrict '$' and '\' characters in usernames supplied on the command line. When an application or wrapper script pas
GHSA
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
ghsa_unreviewed·2026-10-07
CVE-2026-106583 [LOW] CWE-99 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
VulDB
OpenBSD OpenSSH up to 10.5 username command injection (EUVD-2026-94104)
vuldb·2026-10-07·CVSS 2.5
CVE-2026-106583 [LOW] OpenBSD OpenSSH up to 10.5 username command injection (EUVD-2026-94104)
A vulnerability identified as problematic has been detected in OpenBSD OpenSSH up to 10.5. This vulnerability affects unknown code. The manipulation of the argument Username leads to command injection.
This vulnerability is uniquely identified as CVE-2026-106583. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username [fedora-all]
bugzilla·2026-10-19·CVSS 7.8
CVE-2026-106583 [HIGH] CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username [fedora-all]
CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
Bugzilla
CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username [fedora-all]
bugzilla·2026-10-19·CVSS 7.8
CVE-2026-106583 [HIGH] CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username [fedora-all]
CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
Discussion:
*** Bug 2553371 has been marked as a duplicate of this bug. ***
Bugzilla
CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username
bugzilla·2026-10-06·CVSS 7.8
CVE-2026-106583 [HIGH] CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username
CVE-2026-106583 openssh: openssh: Command injection via unvalidated command-line username
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
2026-10-07
Published