CVE-2026-106589: Low severity OpenSSH OpenSSH vulnerability
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed?
The issue is described for certain environments that lack file-descriptor passing and unprivileged PTY allocation, with QNX 6 and SCO OpenServer 5 named as examples. It affects sshd in OpenSSH through 10.6 under those conditions.
What configuration is relevant to exposure?
The affected behavior is related to the GatewayPorts and StreamLocalForwarding sshd configuration options. The provided information does not establish whether systems using default settings are affected.
What security impact can result?
In the affected environments, sshd-session can unexpectedly run with root privileges. The supplied severity vector indicates local access, high attack complexity, no required privileges or user interaction, and integrity impact without stated confidentiality or availability impact.