REDHAT-BUG-2553034: Medium severity OpenSSH OpenSSH vulnerability
A flaw was found in OpenSSH ssh. sshvalidruser did not reject '$' or a backslash that is not at the end of a username entered on the command line. Those characters still expand through %u in ProxyCommand or Match exec. Usernames written in the configuration file are not subject to this check. CVE-2026-35386 is already backported and rejects a different set of shell metacharacters, plus a trailing backslash. Hostnames in that fix already reject '$' and '\'. Usernames do not. This is a new CVE on top of CVE-2026-35386.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to supply a username on the ssh command line containing '$' or a non-trailing backslash. The SSH configuration must use %u in a ProxyCommand or Match exec context, where those characters can then be expanded.
Are usernames defined in SSH configuration files affected in the same way?
No. The described validation gap applies to usernames entered on the command line; usernames written in the configuration file are not subject to this check.
Does the earlier CVE-2026-35386 backport address this issue?
No. That backport rejects a different set of shell metacharacters and a trailing backslash, but it does not reject '$' or a non-trailing backslash in command-line usernames.