CVE-2026-106588
published 2026-10-06CVE-2026-106588: In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
PriorityP411low3.1CVSS 3.1
AVNACHPRLUINSUCNILAN
EPSS
0.13%
2.4th percentile
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | <= 10.6 | — |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
ghsa_unreviewed·2026-10-07
CVE-2026-106588 [LOW] CWE-653 In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
Red Hat
openssh: OpenSSH: Loss of process sandboxing via macOS SDK builds
vendor_redhat·2026-10-06·CVSS 3.1
CVE-2026-106588 [LOW] CWE-653 openssh: OpenSSH: Loss of process sandboxing via macOS SDK builds
openssh: OpenSSH: Loss of process sandboxing via macOS SDK builds
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
A flaw was found in OpenSSH. When built using certain macOS software development kits (SDKs), the SSH server daemon (sshd) disables process sandboxing due to the removal of underlying system interfaces. Consequently, the daemon runs without sandbox isolation, potentially allowing an attacker who compromises the service to access system resources that would normally be restricted.
Statement: A flaw of low security impact was found in OpenSSH in the Red Hat Hardened Images (Hummingbird) context. When OpenSSH's sshd daemon is built using the macOS 27 (or later) SDK, the removal of th
No detection rules found.
No public exploits indexed.
2026-10-06
Published