Red Hat Security AdvisoryRHSA-2026:69266
openssh security, bug fix, and enhancement update
Released 2026-09-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass-8.0p1-33.el8_10
- Red Hat Enterprise Linux BaseOS (v. 8) openssh-8.0p1-33.el8_10, openssh-cavs-8.0p1-33.el8_10, openssh-clients-8.0p1-33.el8_10 +4
Fixes 3 records
Priority LOW 32
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00159 · Published 2026-07-08 · Partial fix · 10.4 CWE-348
Priority LOW 24
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.0025 · Published 2026-07-08 · Partial fix · 10.4 CWE-23
Priority LOW 21
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-08-11 · Partial fix · 10.5 CWE-416
THREATIST.IORead the docs