CVE-2026-35386 LOW

CVE-2026-35386

Vendor Openbsd
Product OpenSSH
Weakness CWE-696
Published April 2, 2026
Last update April 3, 2026
View on NVD All CVEs

CVSS base score

3.6/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

Key dates

02Disclosure timeline

April 2, 2026 CVE published
April 3, 2026 Record updated