CVE-2026-59999: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-59999 is a security feature bypass vulnerability in OpenSSH's sshd daemon where DisableForwarding=yes fails to take precedence over PermitTunnel=yes as documented. All versions of OpenSSH prior to 10.4 are affected. The vulnerability was publicly disclosed on July 8, 2026, coinciding with the release of OpenSSH 10.4. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, or 5.9 (Moderate) per GitHub Advisory Database (reflecting higher attack complexity) (GitHub Advisory, Openwall).

The root cause is an improperly implemented security check (CWE-358) combined with use of a less trusted configuration source (CWE-348): when both DisableForwarding=yes and PermitTunnel=yes are present in sshd_config, the daemon incorrectly honors PermitTunnel=yes rather than allowing DisableForwarding to override it as documented. This means an authenticated SSH user can establish tunnel connections that the administrator explicitly intended to block. The flaw was reported independently by Huzaifa Sidhpurwala of Red Hat and Marko Jevtic (Openwall, GitHub Advisory). Note that PermitTunnel is not enabled by default in OpenSSH, so exploitation requires a non-default server configuration where both directives are set (Openwall).

Successful exploitation allows an authenticated attacker to establish SSH tunnels through a server even when the administrator has explicitly configured DisableForwarding=yes to prevent this. This bypasses an intended network segmentation or access control boundary, potentially enabling lateral movement through restricted network segments reachable via the SSH server. There is no confidentiality or availability impact; the primary risk is integrity-related through unauthorized network tunneling (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The EPSS score is approximately 0.13–0.14%, placing it in the 4th percentile for exploitation likelihood. Exploitation requires authentication and a non-default server configuration (PermitTunnel=yes alongside DisableForwarding=yes), which significantly limits the attack surface. No threat actor attribution or CISA KEV catalog listing has been reported (Openwall).

1. Identify a vulnerable target: Locate an SSH server running OpenSSH prior to version 10.4 that has both DisableForwarding=yes and PermitTunnel=yes set in its sshd_config. This non-default configuration is required for the vulnerability to be exploitable.
2. Obtain valid credentials: Acquire SSH credentials (password, key, or other authentication method) for an account on the target server, as authentication is required.
3. Attempt tunnel creation: Connect to the server using an SSH client and request a tunnel (e.g., using ssh -w for TUN/TAP tunneling): ssh -w 0:0 user@target.
4. Bypass enforcement: Due to the misconfigured precedence logic, the server grants the tunnel request despite DisableForwarding=yes, allowing the attacker to route traffic through the SSH connection into otherwise restricted network segments.
5. Leverage tunnel for lateral movement: Use the established tunnel to access internal network resources that the DisableForwarding policy was intended to block (Openwall, GitHub Advisory).

• Logs: SSH daemon logs (/var/log/auth.log, /var/log/secure, or journalctl -u sshd) showing successful tunnel channel open requests (e.g., tun channel type) from authenticated users on servers where DisableForwarding=yes is configured.
• Network: Unexpected TUN/TAP interface activity on the SSH server host; unusual routed traffic originating from the SSH server process toward internal network segments not normally accessible from the connecting client's network.
• Process: Presence of active tun or tap network interfaces created after SSH session establishment on a server configured with DisableForwarding=yes.
• Configuration Audit: sshd_config files containing both DisableForwarding yes and PermitTunnel yes on OpenSSH versions prior to 10.4 should be treated as potentially exploitable (Red Hat Bugzilla).

Upgrade OpenSSH to version 10.4 or later, which correctly enforces DisableForwarding=yes over PermitTunnel=yes (Openwall). Ubuntu users should apply the patch via USN-8533-1. As an immediate workaround on systems that cannot be upgraded, explicitly set PermitTunnel no in sshd_config to eliminate the conflicting directive — this ensures tunneling is blocked regardless of the DisableForwarding precedence bug. Administrators should audit all sshd_config files for the coexistence of DisableForwarding yes and PermitTunnel yes (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported independently by Huzaifa Sidhpurwala of Red Hat and Marko Jevtic, indicating coordinated discovery prior to the OpenSSH 10.4 release announcement (Openwall). Red Hat opened a Bugzilla tracking entry (Bug 2497942) describing it as a "security bypass due to incorrect handling of forwarding and tunneling options" with medium severity (Red Hat Bugzilla). Security news outlets including SecurityOnline.info covered the OpenSSH 10.4 security fixes, and the vulnerability was tracked across multiple threat intelligence platforms shortly after disclosure.