CVE-2026-35414: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-35414 is an authorization bypass vulnerability in OpenSSH before version 10.3 that mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority (CA) that makes certain use of comma characters. The flaw was disclosed on April 2, 2026, alongside the release of OpenSSH 10.3, which contains the fix. Affected versions include all OpenSSH releases prior to 10.3; IBM AIX and VIOS systems running affected OpenSSH versions are also impacted. The CVSS v3.1 base score varies by source: NVD assigns 8.1 (High) while the GitHub Advisory Database and EUVD assign 4.2 (Moderate), reflecting differing assessments of attack complexity and privilege requirements (GitHub Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-670 (Always-Incorrect Control Flow Implementation): when matching an authorized_keys principals="" option against a list of principals in a certificate, an incorrect algorithm was used that could allow inappropriate matching when a principal name in the certificate contains a comma character (Openwall OSS-Sec). Exploitation requires two specific preconditions: (1) an authorized_keys file that lists more than one principal in the principals= option, and (2) a CA that will issue a certificate encoding more than one of these principal names separated by a comma — a configuration that typical CAs strongly constrain. Critically, this condition only applies to user-trusted CA keys specified in authorized_keys; the main certificate authentication path using TrustedUserCAKeys/AuthorizedPrincipalsFile in sshd_config is not affected. A detailed technical write-up dubbed "SplitSSHell" was published by Cyera, describing how a single comma character broke OpenSSH certificate authentication (Cyera Research).

Successful exploitation could allow an attacker who holds a certificate issued by a CA — where the certificate encodes principal names separated by commas — to authenticate as a user they are not authorized to impersonate, effectively bypassing authorization controls. The confidentiality and integrity impacts are limited to the scope of the authenticated session, but in environments where privileged accounts (including root) are managed via CA-based SSH certificate authentication, this could result in full system compromise. The availability impact is assessed as none to low, and lateral movement is possible if the bypassed account has access to additional systems (GitHub Advisory, Openwall OSS-Sec).

As of the time of disclosure, there was no public proof-of-concept exploit and no confirmed in-the-wild exploitation (GitHub Advisory). A GitHub repository (killercd/CVE-2026-35414) appeared shortly after disclosure, though its content and reliability are unverified. The EPSS score is approximately 0.016–0.036%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity — requiring a specifically misconfigured CA that issues certificates with comma-separated principal names — significantly limits real-world exploitation likelihood (Cyera Research).

1. Reconnaissance: Identify target SSH servers running OpenSSH versions prior to 10.3 that use CA-based certificate authentication via authorized_keys with a principals= option listing multiple principals (e.g., principals="admin,operator").
2. Identify CA configuration: Determine whether the CA in use will issue certificates that encode multiple principal names as a comma-separated value within a single principal field (rather than as separate entries in the principals list).
3. Obtain a malicious certificate: Acquire or craft a certificate from the CA that encodes a principal name containing a comma character (e.g., admin,operator) such that the flawed matching algorithm in OpenSSH incorrectly treats it as matching one of the authorized principals.
4. Authenticate via SSH: Present the crafted certificate during SSH authentication to a target server. Due to the incorrect control flow in the principals matching logic, OpenSSH may incorrectly authorize the connection, granting access as the target user.
5. Achieve unauthorized access: If successful, the attacker gains shell access as the target user, potentially including root, enabling further lateral movement or data exfiltration (Openwall OSS-Sec, Cyera Research).

• Logs: SSH authentication log entries (/var/log/auth.log, /var/log/secure) showing successful certificate-based logins for accounts where the authenticating certificate's principal contains a comma character; unexpected successful logins from users not normally authorized for a given account.
• Network: SSH connections (TCP port 22) from unexpected source IPs authenticating with certificates rather than passwords or standard public keys, particularly to privileged accounts.
• File System: Review authorized_keys files for entries using the principals= option with multiple comma-separated values in conjunction with cert-authority — these are the configurations susceptible to exploitation.
• Process: Unexpected interactive shell sessions or commands executed under privileged accounts (e.g., root) that were authenticated via SSH certificate, especially from unfamiliar source addresses.

Upgrade OpenSSH to version 10.3 or later, which contains the fix for this vulnerability (Openwall OSS-Sec). Downstream distributions including Ubuntu (USN-8222-1), Red Hat (RHSA-2026:12389 and others), Debian, SUSE, AlmaLinux, Rocky Linux, Amazon Linux, and Fedora have released updated packages. IBM has also issued a security bulletin for AIX (IBM Advisory). As a workaround for environments that cannot immediately upgrade, administrators should audit authorized_keys files and avoid using the principals= option with multiple principals in conjunction with CA-based authentication, or migrate CA trust to TrustedUserCAKeys/AuthorizedPrincipalsFile in sshd_config, which is not affected by this flaw.

The vulnerability received significant media attention, with outlets including SecurityWeek and The Hacker News covering it under headlines referencing a "15-year-old OpenSSH flaw" granting root shell access — though this characterization overstates the severity given the high exploitation complexity (SecurityWeek). The Center for Internet Security (CIS) issued an advisory noting the potential for authentication bypass (CIS Advisory). Cyera published a detailed research blog titled "SplitSSHell" that provided the most thorough technical breakdown of the flaw (Cyera Research). Community discussion on Reddit and Mastodon was active, with many practitioners noting that the real-world risk is limited to uncommon CA configurations. Juniper Networks, Palo Alto Networks, and IBM all issued impact assessments for their products.