CVE-2026-110925: 
OpenSSH Analyse et atténuation de la vulnérabilité

CVE-2026-110925 is an OS command injection vulnerability in OpenSSH where shell metacharacters ($ and non-trailing backslash \) in a username supplied on the SSH command line are not properly sanitized. When an SSH configuration expands the %u token inside ProxyCommand or Match exec directives, these characters are passed directly to the shell, enabling potential command injection. The vulnerability affects OpenSSH as shipped in Red Hat products (including RHEL and OpenShift/RHEL CoreOS variants) and was disclosed on October 15, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is insufficient input validation in OpenSSH's ssh_valid_ruser function, which failed to reject $ or non-trailing backslash characters in usernames provided on the command line (CWE-78: Improper Neutralization of Special Elements used in an OS Command). This is a bypass of the earlier fix for CVE-2026-35386, which already rejected a different set of shell metacharacters and a trailing backslash in hostnames, but did not extend the same rejection to $ and \ in usernames. When the SSH client configuration uses %u expansion within ProxyCommand or Match exec blocks, the unsanitized username is interpolated into a shell command, allowing an attacker who controls the username argument to inject arbitrary shell commands. Usernames specified only within the SSH configuration file (not on the command line) are not affected by this flaw (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary OS commands in the context of the user running the SSH client, resulting in limited confidentiality and integrity impacts (low confidentiality, low integrity, no availability impact per CVSS scoring). An attacker could read sensitive files or application data accessible to the SSH client process, or modify data and system state on the client host. Because exploitation requires user interaction (a user must invoke ssh with an attacker-controlled username), the blast radius is constrained to the client environment rather than the SSH server, but could still facilitate further lateral movement if the client has privileged access (Red Hat CVE, GitHub Advisory).

As of the disclosure date (October 15, 2026), no public proof-of-concept exploit code has been identified and there is no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user must run ssh with an attacker-influenced username while a ProxyCommand or Match exec directive using %u is present in the configuration.

1. Identify a target configuration: Determine that the victim's SSH client configuration (~/.ssh/config or /etc/ssh/ssh_config) contains a ProxyCommand or Match exec directive that uses the %u token (e.g., ProxyCommand ssh-proxy %u@gateway).
2. Craft a malicious username: Construct a username containing shell metacharacters such as $ or \ that, when expanded via %u, inject additional shell commands (e.g., user$(malicious_command) or user\nmalicious_command).
3. Induce the victim to run SSH with the malicious username: Social-engineer or otherwise cause the victim to execute ssh 'user$(id > /tmp/pwned)'@target or supply the crafted username through an application that invokes ssh programmatically.
4. Shell command execution: When the SSH client processes the configuration and expands %u in ProxyCommand or Match exec, the injected metacharacters cause the shell to execute the attacker's payload in the context of the SSH client user.
5. Achieve objective: The injected command runs locally on the client host, potentially exfiltrating data, establishing persistence, or enabling further access (Red Hat CVE, Red Hat Bugzilla).

• Logs: Shell command execution logs (e.g., /var/log/auth.log, /var/log/secure) showing unexpected commands spawned around the time of an ssh invocation; audit logs (auditd) recording unusual execve syscalls from the SSH client process.
• Process: Unexpected child processes spawned by the ssh client binary (e.g., bash, sh, curl, wget, python) with unusual arguments or environment variables derived from a username string.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) or the user's home directory shortly after an SSH connection attempt; new cron jobs or authorized keys added by the SSH client user account.
• Network: Outbound network connections initiated by the SSH client process to unexpected external hosts, particularly if the ProxyCommand payload includes a network callback (Red Hat CVE).

Red Hat has acknowledged the vulnerability and a patch is in progress (tracked in Bugzilla 2553034); users should apply vendor-issued updates for OpenSSH as soon as they become available for their Red Hat product (Red Hat Bugzilla). As an immediate workaround, Red Hat advises: do not pass untrusted usernames on the ssh command line when ProxyCommand or Match exec directives expand %u; avoid using %u expansion in shell commands within SSH configuration files when the username source is not fully trusted (Red Hat CVE). Additionally, auditing SSH client configurations to remove or restrict %u usage in ProxyCommand and Match exec blocks reduces exposure until a patch is applied.

Red Hat credited SecBuddyF of KeenLab for discovering and reporting this vulnerability (Red Hat CVE). The GitHub Advisory Database has classified it as "Moderate" severity and marked it as unreviewed, with no package-level fix version yet identified (GitHub Advisory). Broader community and media reaction has been limited given the recent disclosure date and moderate severity rating.