4.2 MediumCWE-670
CVE-2026-35414
OpenBSD OpenSSH vulnerability
OpenBSDOpenSSH
Status
- Not in CISA KEV
- Fixed in version 10.3
Exploit probabilityEPSSchecked 25 Oct
0.2%probability of exploitation in the next 30 days
Higher than 12% of scored CVEs
SeverityCVSS
4.2Medium
Description NVD
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
Coverage 1 article · 1 outlet
- OpenSSH flaw grants root via comma in certificate principalSecurityWeek · first in our coverage