Vulnerability intelligence
CVE-2026-35414
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
CVSS Score
4.2
Medium
EPSS — Exploit Probability
0.2%
Riskier than 7% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
1 article across 1 outlet · first covered Apr 27, 2026 · latest Apr 27, 2026
Coverage timeline
-
OpenSSH flaw grants root via comma in certificate principalwww.securityweek.com · Apr 27, 2026