REDHAT-BUG-2480689: High severity Red Hat OpenSSH vulnerability

Published May 22, 2026

Updated

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Affected Software

1 affected component

Red Hat OpenSSH

Event History

May 22, 2026

Data Sourced

via Red Hat·04:02 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which SSH deployments are exposed to this issue?

Deployments are exposed when the SSH server configuration relies on source-address validation and passes a callback type other than a public-key callback. The provided information does not identify specific affected package versions or configurations beyond that condition.

What condition allows the authorization control to be bypassed?

Source-address validation is skipped when a callback other than a public-key callback is passed. An attacker would therefore need to interact with an SSH server configured in a way that triggers this non-public-key callback path.

REDHAT-BUG-2480689: High severity Red Hat OpenSSH vulnerability

Affected Software

Event History

Frequently Asked Questions

Which SSH deployments are exposed to this issue?

What condition allows the authorization control to be bypassed?

Company

Resources

Contact

Frequently Asked Questions

Which SSH deployments are exposed to this issue?

What condition allows the authorization control to be bypassed?