CVE-2026-110925: Openssh: openssh: '$' and '\' in a command-line username expand through %u
A flaw was found in OpenSSH ssh. sshvalidruser did not reject '$' or a backslash that is not at the end of a username entered on the command line. Those characters still expand through %u in ProxyCommand or Match exec. Usernames written in the configuration file are not subject to this check. CVE-2026-35386 is already backported and rejects a different set of shell metacharacters, plus a trailing backslash. Hostnames in that fix already reject '$' and '\'. Usernames do not. This is a new CVE on top of CVE-2026-35386.
Other sources
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenSSH clients are exposed when a username supplied on the ssh command line is expanded through %u in a ProxyCommand or Match exec configuration directive. Configurations that do not use %u in those shell-executed directives are not described as affected.
What does an attacker need to exploit it?
The attacker needs a victim to use ssh with a command-line username containing '$' or a non-trailing backslash, and for the applicable SSH configuration to expand %u in ProxyCommand or Match exec. The issue requires user interaction, as reflected by the UI:R vector.
Are usernames defined in SSH configuration files affected?
No. The described validation check applies to usernames entered on the command line; usernames written in the configuration file are explicitly not subject to this check.
How can exposure be reduced before a fix is available?
Avoid using command-line usernames containing '$' or non-trailing backslashes, especially where ProxyCommand or Match exec expands %u. Review SSH configurations for those directives and their use of %u.
Does the earlier CVE-2026-35386 backport address this flaw?
No. That backport rejects a different set of shell metacharacters and a trailing backslash, but this issue covers '$' and non-trailing backslashes in command-line usernames.