CVE-2026-35388: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-35388 is a low-severity vulnerability in OpenSSH before version 10.3 in which connection multiplexing confirmation is omitted for proxy-mode multiplexing sessions (i.e., ssh -O proxy ...). This flaw was disclosed on April 2, 2026, alongside the OpenSSH 10.3 release announcement. It affects all OpenSSH versions prior to 10.3, including distributions shipping those versions (IBM AIX, Red Hat, Ubuntu, Debian, AlmaLinux, Rocky Linux, Amazon Linux, SUSE, and others). The CVSS v3.1 base score is 2.5 (Low) (GitHub Advisory, oss-security).

The root cause is classified as CWE-420 (Unprotected Alternate Channel): OpenSSH protects standard multiplexed sessions with a confirmation mechanism when ControlMaster ask/autoask is configured, but this confirmation was not applied to proxy-mode multiplexing sessions initiated via ssh -O proxy. As a result, a local attacker who can influence the proxy-mode session setup — with user interaction — could inject an unauthorized session into an existing multiplexed connection without the expected confirmation prompt. The vulnerability was reported by Michalis Vasileiadis and fixed in OpenSSH 10.3 (oss-security, GitHub Advisory).

Successful exploitation allows a local attacker to inject an unauthorized SSH session into a proxy-mode multiplexed connection, compromising the integrity of that session. There is no confidentiality or availability impact; the effect is limited to low-severity integrity degradation of the multiplexed channel. The attack requires local access to the system and user interaction, significantly constraining the practical impact and scope of exploitation (GitHub Advisory, oss-security).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.011–0.017%, placing it in the low percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local system access and user interaction, making opportunistic or remote exploitation infeasible (GitHub Advisory, Feedly).

Upgrade OpenSSH to version 10.3 or later, which includes the fix for this vulnerability. Major Linux distributions have released patched packages: Ubuntu (USN-8222-1), Red Hat (RHSA-2026:12389 and related errata), Debian (LTS announcement May 2026), AlmaLinux, Rocky Linux, Amazon Linux 2/2023, SUSE, and IBM AIX. No configuration-based workaround is documented; upgrading is the recommended remediation. Given the low severity and local-access requirement, this can be addressed in routine patching cycles (oss-security, Ubuntu Advisory, IBM Advisory).

The vulnerability was disclosed by OpenBSD's Damien Miller via the oss-security mailing list as part of the OpenSSH 10.3 release announcement on April 2, 2026. The reporter, Michalis Vasileiadis, was credited in the release notes. Coverage was largely routine, appearing in Linux security news aggregators and distribution security advisories; no significant controversy or elevated community concern was noted given the low CVSS score and constrained attack conditions (oss-security, SecurityOnline).