CVE-2026-106587

Published: Oct 6, 2026Modified: Oct 9, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

Affected (1)

Products: Openbsd: Openssh

Openbsd

1 product

Openssh

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	version < 10.6

Related CWEs

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (1)

https://www.openssh.org/releasenotes.html#10.6

Source: cve@mitre.org

Release Notes

Timeline

No history available yet.