CVE-2026-35386: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-35386 is a shell metacharacter injection vulnerability in OpenSSH before version 10.3 that can allow command execution when an untrusted username is passed on the command line. The flaw requires a non-default ssh_config configuration using % token expansion (e.g., %u in a Match exec block). It affects all OpenSSH versions prior to 10.3, as well as downstream products including IBM AIX/VIOS and Microsoft Azure Linux 3 packages. The vulnerability was publicly disclosed on April 2, 2026, coinciding with the OpenSSH 10.3 release. CVSS scores differ by source: NVD/Feedly assign a CVSS v3.1 score of 8.1 (High) with a network attack vector, while GitHub Advisory Database and ENISA assign a lower score of 3.6 (Low) reflecting a local attack vector with required privileges (GitHub Advisory, oss-security).

The root cause is classified as CWE-696 (Incorrect Behavior Order): validation of shell metacharacters in usernames supplied on the ssh(1) command line was performed too late, after %-token expansion in ssh_config had already occurred. This means that if a configuration directive such as Match exec uses the %u token (which expands to the username), an attacker-controlled username containing shell metacharacters can be expanded and executed by the shell before sanitization takes effect. Exploitation requires two preconditions: (1) the username passed to ssh(1) on the command line must be attacker-controlled (e.g., in a wrapper script or automated pipeline), and (2) the ssh_config must use a non-default %-token configuration such as %u in a Match exec block. The vulnerability was reported by Florian Kohnhäuser and disclosed in the OpenSSH 10.3 release announcement (oss-security, GitHub Advisory).

Successful exploitation allows an attacker who can control the username argument passed to ssh(1) to execute arbitrary shell commands on the system running the SSH client, with the privileges of the user invoking ssh. The impact is limited to environments with the specific non-default ssh_config configuration; default OpenSSH deployments are not affected. In vulnerable configurations, confidentiality, integrity, and availability of the affected system could all be compromised, potentially enabling lateral movement if the SSH client is used in automated or privileged workflows (oss-security, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.007% (0.000070), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The high attack complexity and requirement for non-default configuration significantly limit the exploitable attack surface.

1. Identify a vulnerable target: Find a system running OpenSSH before 10.3 where ssh(1) is invoked with an attacker-controlled username (e.g., via a wrapper script, CI/CD pipeline, or automated SSH utility).
2. Confirm non-default ssh_config: Verify that the target's ssh_config (or ~/.ssh/config) contains a %-token directive that incorporates the username, such as Match exec "some-command %u" or similar.
3. Craft a malicious username: Construct a username containing shell metacharacters designed to inject commands, for example: validuser; malicious-command # or using backtick/subshell syntax.
4. Trigger ssh invocation: Cause the vulnerable system to invoke ssh with the crafted username on the command line, e.g., ssh 'validuser;id #'@target.
5. Achieve command execution: The %u token in the Match exec block expands the malicious username before sanitization, causing the shell to execute the injected command with the privileges of the user running ssh (oss-security).

• Logs: Unexpected or anomalous shell command output in SSH client logs; unusual process invocations logged by audit frameworks (e.g., auditd) originating from ssh or its child processes.
• Process: Unexpected child processes spawned by ssh(1) (e.g., /bin/sh, bash, curl, wget, nc) that are not typical for normal SSH usage.
• File System: Unexpected files created or modified in directories writable by the user invoking ssh, particularly if created around the time of SSH connections.
• Network: Outbound connections initiated by processes that are children of ssh(1) to unexpected external hosts, which may indicate a reverse shell or data exfiltration attempt.

The primary remediation is to upgrade OpenSSH to version 10.3 or later, which validates shell metacharacters in usernames before %-token expansion occurs (oss-security). As a workaround, administrators should audit ssh_config files and remove or avoid non-default %-token configurations (especially %u in Match exec blocks) if not strictly required. Ensure that usernames passed to ssh(1) on the command line are always from trusted, validated sources — never directly from untrusted user input. Downstream vendors including Red Hat, Ubuntu, Debian, AlmaLinux, Rocky Linux, Amazon Linux, IBM AIX, and Fedora have released patched packages (IBM Advisory, GitHub Advisory).

The OpenSSH development team disclosed the vulnerability responsibly alongside the 10.3 release, crediting Florian Kohnhäuser for the report and noting that direct exposure of ssh(1) command lines to untrusted input is strongly discouraged (oss-security). Security coverage appeared on SecurityOnline.info shortly after disclosure, and the vulnerability was picked up by multiple Linux distribution security teams including Red Hat, Ubuntu, Debian, and Fedora, all of whom issued advisories and patched packages. Juniper Networks also published an impact assessment for Junos OS and Junos OS Evolved platforms. Community reaction was measured, reflecting the limited exploitability due to the non-default configuration requirement.