CVE-2026-0964: 
NixOS vulnerability analysis and mitigation

CVE-2026-0964 is a path traversal vulnerability in the libssh SCP client implementation, classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A malicious SCP server can send unexpected file paths that cause the libssh client to write files outside the intended working directory, potentially overwriting local files or placing malicious executables and configuration files in arbitrary locations. The vulnerability mirrors the same issue previously identified in OpenSSH and tracked as CVE-2019-6111. It affects libssh versions prior to 0.11.4, as well as Red Hat Enterprise Linux 8, 9, and 10, and OpenShift Container Platform 4.0. First reported on February 10, 2026, and published to NVD on March 26, 2026, it carries a CVSS v3.1 base score of 6.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper sanitization of file paths received from SCP servers (CWE-22). When a libssh-based SCP client downloads files, it trusts the path information returned by the server without adequately validating or restricting it to the intended working directory. An attacker controlling an SCP server can craft responses containing path traversal sequences (e.g., ../) that cause the client to write file contents to arbitrary locations on the victim's filesystem. Exploitation requires the victim to initiate an SCP file transfer to a malicious or compromised server, making user interaction a prerequisite. This is structurally identical to the OpenSSH SCP path traversal issue CVE-2019-6111, for which public exploitation techniques are well-documented (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows an attacker operating a malicious SCP server to overwrite arbitrary local files on the victim's system, including executables, shell configuration files (e.g., .bashrc, .profile), or SSH authorized keys. This can lead to unauthorized code execution if the victim subsequently runs a replaced or newly placed malicious binary, with low-to-moderate impact on confidentiality, integrity, and availability. The attack scope is limited to the victim's local system and does not directly enable lateral movement, but persistence mechanisms or credential theft via replaced configuration files could facilitate further compromise (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit specific to CVE-2026-0964 in libssh has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.037%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack pattern is well understood due to its similarity to CVE-2019-6111 in OpenSSH, for which exploitation techniques are publicly available, lowering the barrier for a motivated attacker (Red Hat CVE).

1. Set up a malicious SCP server: The attacker configures a server that responds to SCP protocol requests but crafts file transfer responses containing path traversal sequences (e.g., filenames like ../../.bashrc or ../../.ssh/authorized_keys).
2. Lure the victim: The attacker social-engineers or otherwise induces a user running a vulnerable libssh-based SCP client (version < 0.11.4) to initiate an SCP download from the attacker-controlled server (e.g., scp attacker-server:/files/* ./downloads/).
3. Deliver malicious path in server response: During the SCP protocol exchange, the server sends a crafted C (copy) command with a path containing ../ sequences, such as C0755 1234 ../../.ssh/authorized_keys.
4. Client writes file outside working directory: The vulnerable libssh client, lacking proper path sanitization, writes the received file content to the traversed path (e.g., overwriting ~/.ssh/authorized_keys with attacker-controlled content).
5. Achieve objective: Depending on the file overwritten, the attacker may gain persistent SSH access (via injected authorized keys), execute arbitrary code on next login (via modified shell rc files), or establish other persistence mechanisms (Red Hat Bugzilla, Red Hat CVE).

• File System: Unexpected modification timestamps on files outside the intended SCP download directory, particularly in ~/.ssh/, ~/.bashrc, ~/.profile, or other user home directory files; presence of new or altered files in sensitive directories shortly after an SCP transfer.
• Logs: SCP client logs or shell history showing connections to unfamiliar or untrusted SCP servers; audit logs (e.g., auditd) recording file writes to paths outside the expected download directory during or after an SCP session.
• Network: Outbound SCP/SSH connections (TCP port 22) to previously unseen or suspicious IP addresses or hostnames initiated by users or automated scripts.
• Process: Unexpected execution of scripts or binaries from user home directories or configuration files shortly after an SCP transfer event.

The primary remediation is to upgrade libssh to version 0.11.4 or later, which includes the fix for improper path sanitization in the SCP client (libssh Security Release). Red Hat has released patches via RHSA-2026:18160 (RHEL 10, upgrading to libssh-0.12.0-2.el10) and RHSA-2026:18683 (RHEL 9, upgrading to libssh-0.10.4-18.el9) (Red Hat RHSA-18160, Red Hat RHSA-18683). Microsoft has also released updates for Azure Linux 3 libssh packages (Microsoft MSRC). As a workaround where patching is not immediately possible, users should avoid using SCP with untrusted servers and consider switching to SFTP, which does not have this path traversal issue.

The libssh project released versions 0.12.0 and 0.11.4 as security releases on February 10, 2026, explicitly addressing this and related vulnerabilities (libssh Security Release). Red Hat rated the issue as "Moderate" severity and issued coordinated errata for RHEL 9 and 10. The vulnerability drew attention from the Linux security community, with advisories issued by Ubuntu (USN-8051-1, USN-8051-2), SUSE, Slackware, Fedora, and other distributions, reflecting broad ecosystem impact. The issue was noted as a recurrence of the well-known CVE-2019-6111 OpenSSH SCP path traversal class, which generated commentary about the persistence of this vulnerability pattern across SSH implementations.