Red Hat Security AdvisoryRHSA-2026:69130
openssh security update
Released 2026-09-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass-9.9p1-11.el9_8, pam_ssh_agent_auth-0.10.4-8.11.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) openssh-9.9p1-11.el9_8, openssh-clients-9.9p1-11.el9_8, openssh-keycat-9.9p1-11.el9_8 +1
Fixes 5 records
Priority LOW 32
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00159 · Published 2026-07-08 · Partial fix · 10.4 CWE-348
Priority LOW 24
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.0025 · Published 2026-07-08 · Partial fix · 10.4 CWE-23
Priority LOW 21
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-08-11 · Partial fix · 10.5 CWE-416
Priority LOW 16
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVSS 3.1LOW 3.5· Network · Low privileges · No interaction · EPSS 0.00158 · Published 2026-08-11 · Partial fix · 10.5 CWE-669
Priority LOW 12
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
CVSS 3.1LOW 2.5· Local · Low privileges · No interaction · EPSS 0.00148 · Published 2026-08-11 · Partial fix · 10.5 CWE-670
THREATIST.IORead the docs