Medium severity4.2NVD Advisory· Published Apr 2, 2026· Updated Apr 10, 2026
CVE-2026-35414
CVE-2026-35414
Description
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
45- Range: <10.3
- osv-coords43 versionspkg:rpm/almalinux/opensshpkg:rpm/almalinux/openssh-askpasspkg:rpm/almalinux/openssh-cavspkg:rpm/almalinux/openssh-clientspkg:rpm/almalinux/openssh-keycatpkg:rpm/almalinux/openssh-keysignpkg:rpm/almalinux/openssh-ldappkg:rpm/almalinux/openssh-serverpkg:rpm/almalinux/pam_ssh_agent_authpkg:rpm/opensuse/openssh&distro=openSUSE%20Tumbleweedpkg:rpm/suse/openssh8.4&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/openssh8.4&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4%20LTSS%20EXTREME%20COREpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4%20LTSS%20EXTREME%20COREpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
< 9.9p1-14.el10_1.alma.1+ 42 more
- (no CPE)range: < 9.9p1-14.el10_1.alma.1
- (no CPE)range: < 9.9p1-14.el10_1.alma.1
- (no CPE)range: < 8.0p1-29.el8_10
- (no CPE)range: < 9.9p1-14.el10_1.alma.1
- (no CPE)range: < 9.9p1-14.el10_1.alma.1
- (no CPE)range: < 9.9p1-14.el10_1.alma.1
- (no CPE)range: < 8.0p1-29.el8_10
- (no CPE)range: < 9.9p1-14.el10_1.alma.1
- (no CPE)range: < 0.10.4-5.49.el9_7.alma.1
- (no CPE)range: < 10.3p1-4.1
- (no CPE)range: < 8.4p1-8.24.1
- (no CPE)range: < 8.4p1-8.24.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 9.6p1-150600.6.42.1
- (no CPE)range: < 6.6p1-36.31.1
- (no CPE)range: < 7.2p2-81.40.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 9.6p1-150600.6.42.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 9.6p1-150600.6.42.1
- (no CPE)range: < 7.2p2-81.40.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 9.6p1-150600.6.42.1
- (no CPE)range: < 6.6p1-36.31.1
- (no CPE)range: < 7.2p2-81.40.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 9.6p1-150600.6.42.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 8.4p1-150300.3.65.1
- (no CPE)range: < 9.6p1-150600.6.42.1
- (no CPE)range: < 7.2p2-81.40.1
Patches
Vulnerability mechanics
References
3- marc.infonvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/04/02/3nvdThird Party Advisory
- www.openssh.org/releasenotes.htmlnvdRelease Notes
News mentions
2- Debian 13.5 point release lands with security fixes, bug patchesHelp Net Security · May 17, 2026
- ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & MoreThe Hacker News · May 4, 2026