OESA-2026-4691: openssh security update
An open source implementation of SSH protocol version 2 Security Fix(es):
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.(CVE-2026-106587)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/opensshto a version that resolves this vulnerability.Fixed in 8.8p1-52.oe2203sp4
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required.
What is the security impact if exploitation succeeds?
The listed impact is limited to integrity, with no reported confidentiality or availability impact. The severity is rated low at 3.3.
Which OpenSSH versions are affected?
The issue affects sshd in OpenSSH versions before 10.6. The advisory identifies the affected software as openEuler's openssh package.