Red Hat Security AdvisoryRHSA-2026:21298
openssh security update
Released 2026-05-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) openssh-8.0p1-20.el8_8.4, openssh-clients-8.0p1-20.el8_8.4, openssh-server-8.0p1-20.el8_8.4
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) openssh-8.0p1-20.el8_8.4, openssh-clients-8.0p1-20.el8_8.4, openssh-server-8.0p1-20.el8_8.4
Fixes 5 records
Priority LOW 38
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (pres…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00573 · Published 2026-04-02 · Partial fix · 10.3 CWE-281
Priority LOW 37
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00324 · Published 2026-04-02 · Partial fix · 10.3 CWE-696
Priority LOW 35
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00218 · Published 2026-04-02 · Partial fix · 10.3 CWE-670
Priority LOW 28
OpenSSH before 10.3 can use unintended ECDSA algorithms.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00241 · Published 2026-04-02 · Partial fix · 10.3 CWE-670
Priority LOW 12
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
CVSS 3.1LOW 2.5· Local · No auth · User interaction · EPSS 0.00132 · Published 2026-04-02 · Partial fix · 10.3 CWE-420
THREATIST.IORead the docs