Apache MINA SSHD: Four Vulnerabilities Including Path Traversal Disclosed Together
Apache MINA SSHD faces a disclosure of four vulnerabilities, including path traversal and improper validation flaws, impacting server-side security.
Key findings
- Four vulnerabilities disclosed together for Apache MINA SSHD on July 21, 2026.
- Two path traversal vulnerabilities (CVE-2026-56623, CVE-2026-56452) affect sshd-git and sshd-scp components.
- CVE-2026-56624 involves improper certificate validation in server-side authentication.
- CVE-2026-58624 allows improper input validation for remote Git command execution via sshd-git.
On July 21, 2026, a batch of four vulnerabilities was disclosed for Apache MINA SSHD, a Java library for client-side and server-side SSH. These vulnerabilities, all disclosed on the same day, highlight issues in certificate validation, input validation, and path traversal within different components of the library. The disclosures collectively impact the security of SSH servers built using Apache MINA SSHD, potentially allowing unauthorized access and command execution.
Two of the disclosed vulnerabilities, CVE-2026-56623 and CVE-2026-56452, involve path traversal. CVE-2026-56623 specifically affects the sshd-git component when running on Windows. It could allow an authenticated remote user to access Git repositories outside of their configured directory. Similarly, CVE-2026-56452 impacts the sshd-scp component, where the SCP file receiving functionality did not properly validate filenames. This could enable a malicious sender to craft filenames with path components, leading to unintended file access or modification.
Further compounding the security concerns, CVE-2026-56624 addresses an improper certificate validation flaw in the server-side of Apache MINA SSHD. During user authentication, the server's handling of OpenSSH user certificates failed to check for unsupported force-command or verify-required options, potentially weakening authentication mechanisms. Additionally, CVE-2026-58624 points to an improper input validation issue within the sshd-git component. This vulnerability could be exploited through the GitPgmCommandFactory, allowing SSH clients to remotely execute arbitrary Git commands.
The disclosed vulnerabilities affect various components of Apache MINA SSHD, including sshd-git and sshd-scp. While specific version information for affected releases and patched versions are not detailed in the provided information, users of Apache MINA SSHD are advised to consult official advisories for the latest updates and mitigation strategies. The simultaneous disclosure of these vulnerabilities underscores the importance of regularly updating and securing SSH server implementations.
This batch of vulnerabilities serves as a reminder for developers and administrators utilizing Apache MINA SSHD to remain vigilant about security updates. The diverse nature of the flaws, ranging from authentication bypass to arbitrary command execution and unauthorized file access, highlights the critical need for thorough security practices when deploying SSH solutions. Users should prioritize applying any available patches and reviewing their configurations to mitigate these risks.