← Back

CVE-2026-106583

nvd nist
Published: Oct 7, 2026Modified: Oct 15, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

Affected (1)

Products: Openbsd: Openssh
Openbsd
1 product
Openssh
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Openssh
version < 10.6

Related CWEs

CWE-99
Improper Control of Resource Identifiers ('Resource Injection')
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

References (1)

Source: cve@mitre.org
Release Notes

Timeline

No history available yet.