CVE-2026-106583: High severity OpenSSH OpenSSH vulnerability

Q: What conditions are required for exploitation?

An attacker needs local access and low privileges. Exploitation has high attack complexity and does not require user interaction.

Q: Which environments should be prioritized for review?

Review systems running OpenSSH versions before 10.6, particularly where command-line usernames may contain attacker-controlled $ or \ characters.

Q: What is the expected security impact?

The CVSS vector indicates low integrity impact, with no confidentiality or availability impact.

Published Oct 6, 2026

Updated

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

Affected Software

4 affected componentsFixes available

OpenSSH OpenSSH<10.6

OpenBSD OpenSSH<10.6

debian/openssh<=1:9.2p1-2+deb12u10, <=1:9.2p1-2+deb12u9, <=1:10.0p1-7+deb13u4, <=1:10.0p1-7+deb13u2

1:10.6p1-1

debian/openssh-gssapi

1:10.6p1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/openssh to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade debian/openssh-gssapi to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade OpenSSH to a version that resolves this vulnerability.
Fixed in 10.6

Event History

Oct 6, 2026

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionSeverityWeakness

Oct 7, 2026

Data Sourced

via NVD·12:17 AM

DescriptionSeverityWeaknessAffected Software

Oct 8, 2026

Data Sourced

via Microsoft·08:11 AM

DescriptionSeverityWeakness

Oct 14, 2026

Data Sourced

via Launchpad·02:50 PM

Description

Data Sourced

via Debian·02:50 PM

DescriptionAffected Software

Oct 15, 2026

Data Sourced

via Ubuntu·02:50 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs local access and low privileges. Exploitation has high attack complexity and does not require user interaction.

Which environments should be prioritized for review?

Review systems running OpenSSH versions before 10.6, particularly where command-line usernames may contain attacker-controlled $ or \ characters.

What is the expected security impact?

The CVSS vector indicates low integrity impact, with no confidentiality or availability impact.

CVE-2026-106583: High severity OpenSSH OpenSSH vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which environments should be prioritized for review?

What is the expected security impact?

Company

Resources

Contact