CVE-2026-106587
published 2026-10-06CVE-2026-106587: In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is…
PriorityP411low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.08%
0.3th percentile
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.6 | 10.6 |
| openbsd | openssh | — | — |
| ubuntu | openssh | — | — |
| ubuntu | openssh-gssapi | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_ubuntu6.5MEDIUM
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
ghsa_unreviewed·2026-10-07
CVE-2026-106587 [LOW] CWE-843 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 6.5
CVE-2026-106553 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 6.5
CVE-2026-106552 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote
attacker controlling the server could possibly use this issue to write
files to unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous
failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Red Hat
openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options
vendor_redhat·2026-10-06·CVSS 3.3
CVE-2026-106587 [LOW] CWE-115 openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options
openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon (sshd) incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by creating or manipulating a file named "none", potentially leading to improper access control enforcement or service disruption.
Statement: A low severity flaw was found in OpenSSH, affecting the openssh component shipped in Red Hat
No detection rules found.
No public exploits indexed.
2026-10-06
Published