CVE-2026-59999
published 2026-07-08CVE-2026-59999: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.16%
4.7th percentile
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.4 | 10.4 |
| openbsd | openssh | — | — |
| ubuntu | openssh | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vendor_ubuntu8.1HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
vendor_redhat·2026-10-15·CVSS 7.5
CVE-2026-110928 [HIGH] CWE-284 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
A flaw was found in OpenSSH. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel.
Statement: Red Hat Enterprise Linux is not affected. The downstream patch for CVE-2026-59999 is stricter than the upstream OpenSSH 10.6 fix for this tunnel restriction. PermitTunnel is disabled by default.
Mitigation: No mitigation is required for Red Hat Enterprise Linux. On other builds, keep PermitTunnel set to no.
Package: openssh (Red Hat Enterprise Linux 10) - Not affected
Package: openssh (Red Hat Enterprise Linux 6) - Not affected
Package: openssh (Red Hat Enterprise Linux 7) - Not affected
Package: openssh (Red Hat Enterp
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 8.1
CVE-2026-73282 [HIGH] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell
metacharacters in certain usernames. An attacker could possibly use this
issue to execute arbitrary commands when certain non-default
configurations were used, resulting in arbitrary code execution. This
issue only affected Ubuntu 14.04 LTS. (CVE-2026-35386)
Christos Papakonstantinou discovered that OpenSSH incorrectly handled
ECDSA algorithm restrictions. An attacker could possibly use this issue
to cause unintended ECDSA algorithms to be accepted, resulting in
security restrictions being bypassed. (CVE-2026-35387)
Vladimir Tokarev discovered that OpenSSH incorrectly handled certain
principal restrictions in authorized_keys files.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-07-13·CVSS 5.4
CVE-2026-60001 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH sftp did not properly constrain the location
of downloaded files when connecting to an attacker-controlled server. An
attacker could possibly use this issue to write files to unintended
locations on the file system. (CVE-2026-59995)
It was discovered that OpenSSH scp could place files in the parent
directory of the intended destination when copying between two remote
hosts. An attacker could possibly use this issue to write files to
unintended locations. (CVE-2026-59996)
It was discovered that OpenSSH internal-sftp only recognized the first nine
command-line arguments, This could result in certain security-sensitive
arguments being ignored, contrary to expectations. (CV
Red Hat
openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
vendor_redhat·2026-07-08·CVSS 5.9
CVE-2026-59999 [MEDIUM] CWE-358 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.
Package: openssh (Red Hat Enterprise Linux 10) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 6) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 7) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 8) - Fix deferred
Package: openssh
GHSA
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
ghsa_unreviewed·2026-07-08
CVE-2026-59999 [MEDIUM] CWE-348 In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
VulDB
OpenBSD OpenSSH up to 10.3 privilege escalation
vuldb·2026-07-08·CVSS 5.9
CVE-2026-59999 [MEDIUM] OpenBSD OpenSSH up to 10.3 privilege escalation
A vulnerability was found in OpenBSD OpenSSH up to 10.3 and classified as problematic. This affects an unknown function. The manipulation results in privilege escalation.
This vulnerability was named CVE-2026-59999. The attack needs to be approached within the local network. There is no available exploit.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-110928 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
bugzilla·2026-10-15·CVSS 7.5
CVE-2026-110928 [HIGH] CVE-2026-110928 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
CVE-2026-110928 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
A flaw was found in OpenSSH sshd. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. A key or certificate principal marked restrict could still open a tunnel when PermitTunnel was enabled. PermitTunnel is disabled by default. This is separate from the tunnel check added in OpenSSH 10.5 (CVE-2026-73283). The RHEL maintainer reported that the downstream patch openssh-10.4p1-CVE-2026-59999.patch is stricter than the upstream fix, so Red Hat Enterprise Linux is not affected. Reserve the CVE for upstream. Do not file RHEL trackers.
Bugzilla
CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options [fedora-all]
bugzilla·2026-08-11·CVSS 7.5
CVE-2026-59999 [HIGH] CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options [fedora-all]
CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Bugzilla
CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
bugzilla·2026-07-08·CVSS 5.9
CVE-2026-59999 [MEDIUM] CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
2026-07-08
Published