CVE-2026-106589
published 2026-10-06CVE-2026-106589: In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is…
PriorityP412low2.9CVSS 3.1
AVLACHPRNUINSUCNILAN
EPSS
0.08%
0.2th percentile
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | <= 10.6 | — |
CVSS provenance
nvdv3.12.9LOWCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges.
ghsa_unreviewed·2026-10-07
CVE-2026-106589 [LOW] CWE-272 In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges.
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
Red Hat
openssh: OpenSSH: Privilege escalation via retained root privileges in sshd-session
vendor_redhat·2026-10-06·CVSS 2.9
CVE-2026-106589 [LOW] CWE-250 openssh: OpenSSH: Privilege escalation via retained root privileges in sshd-session
openssh: OpenSSH: Privilege escalation via retained root privileges in sshd-session
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
A flaw was found in OpenSSH. This vulnerability may allow privilege escalation on operating systems that lack support for file-descriptor passing and unprivileged terminal device allocation. In these environments, the session process unexpectedly retains administrative (root) privileges after user authentication. When port or socket forwarding features are enabled, an authenticated user ca
No detection rules found.
No public exploits indexed.
2026-10-06
Published