CVE-2026-59846: Libssh: libssh: information disclosure via proxycommand %r username expansion
A flaw was found in libssh username handling for ProxyCommand expansion. The sshcheckusernamesyntax() validation path in src/misc.c used an incomplete dangerous-character filter for usernames expanded through %r. As a result, specially crafted usernames containing shell-significant characters could reach shell-evaluated ProxyCommand handling and influence shell expansion, exposing environment variables and causing unintended shell behavior. This issue affects clients that combine untrusted username input with ProxyCommand-style shell execution.
Other sources
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59846?
CVE-2026-59846 has a severity rating of low with a score of 3.9.
How do I fix CVE-2026-59846?
To fix CVE-2026-59846, update libssh to the latest version that addresses this vulnerability.
What is the impact of CVE-2026-59846?
CVE-2026-59846 can lead to information disclosure through improper handling of usernames by ProxyCommand.
Is CVE-2026-59846 a command injection vulnerability?
Yes, CVE-2026-59846 is categorized under command injection due to its flaw in username handling.
Who is affected by CVE-2026-59846?
CVE-2026-59846 affects users of libssh that utilize ProxyCommand with specific username expansions.