Read the docs
TI-2026-40830 Aliases CVE-2026-56624GHSA-j262-jh5j-p4fw

Apache MINA SSHD: SSH certificate options lack validations

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 16 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*[email protected] user certificates (which are the only ones for which verify-required would make sense).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Partial Red Hat: 16 advisoriesRed Hat: 16 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MINA SSHD2.0.0 – 2.18.0; 3.0.0-M1 – 3.0.0-M4—No fix listedCNA
  • Apache MINA SSHD VendorApache Affected 2.0.0 – 2.18.0; 3.0.0-M1 – 3.0.0-M4 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*2.0.0 to before 2.19.0VulnerableApache
cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:*3.0.0 m1VulnerableApache
cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:*3.0.0 m2VulnerableApache
cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:*3.0.0 m3VulnerableApache
cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:*3.0.0 m4VulnerableApache
  • cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.19.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:* Versions 3.0.0 m1 Vulnerable ·Apache
  • cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:* Versions 3.0.0 m2 Vulnerable ·Apache
  • cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:* Versions 3.0.0 m3 Vulnerable ·Apache
  • cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:* Versions 3.0.0 m4 Vulnerable ·Apache

Remediation

Red Hat 16 advisories

  • RHSA-2026:95887 Released 2026-11-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 13 more Red Hat advisories
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:54776 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)
    • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • RHSA-2026:53643 Released 2026-08-13 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5 release and security update
    • Red Hat build of Quarkus 3.27.5
  • RHSA-2026:51653 Released 2026-08-13 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3 release and security update
    • Red Hat build of Quarkus 3.33.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33Fixed RHSA-2026:54776
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95887
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Quarkus 3.27.5Fixed RHSA-2026:53643
Red Hat build of Quarkus 3.33.3Fixed RHSA-2026:51653
Not affected: 16 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56624
  2. 2026-10-03 Alias added: GHSA-j262-jh5j-p4fw
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-11-06 Fix available: RHSA-2026:95887 · Red Hat
  5. 2026-11-06 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat

References

Advisory 2

  • TI-2019-04327 An issue was discovered in OpenSSH 7.9. CVSS 3.1MEDIUM 5.9
  • TI-2026-40791 Apache MINA SSHD: Path traversal in SCP file reception CVSS 3.1HIGH 7.5
  • TI-2026-40829 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows CVSS 3.1HIGH 7.1
  • TI-2026-36095 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git CVSS 3.1HIGH 7.1
  • TI-2024-27935 Apache MINA SSHD: integrity check bypass CVSS 3.1MEDIUM 5.9
  • TI-2026-42194 Apache MINA SSHD: Remote execution of JGit commands can write files on the server CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences