Low severity3.6NVD Advisory· Published Apr 2, 2026· Updated Apr 27, 2026
CVE-2026-35386
CVE-2026-35386
Description
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- marc.infonvdThird Party Advisory
- www.openwall.com/lists/oss-security/2026/04/02/3nvdThird Party Advisory
- www.openssh.org/releasenotes.htmlnvdRelease Notes
News mentions
0No linked articles in our index yet.