← All advisories

Medium severity5.9NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-59999

CVE-2026-59999

Description

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

Affected products

14

osv-coords11 versions
pkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0 pkg:rpm/almalinux/openssh-askpass pkg:rpm/almalinux/openssh-ldap pkg:rpm/almalinux/openssh-clients pkg:rpm/almalinux/openssh-server pkg:rpm/almalinux/openssh-keysign pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0 pkg:rpm/almalinux/openssh-keycat pkg:rpm/almalinux/openssh-cavs pkg:rpm/almalinux/openssh pkg:rpm/almalinux/pam_ssh_agent_auth
< 10.0p2-160000.7.1+ 10 more
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 8.0p1-33.el8_10
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 8.0p1-33.el8_10
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 0.10.4-8.11.el9_8.alma.1
OpenBSD/OpenSSH
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Range: <10.4
OpenSSH/sshdllm-fuzzy
Range: <10.4
OpenSSH/OpenSSHllm-fuzzy
Range: <10.4

Patches

Vulnerability mechanics

References

3

marc.infonvdRelease Notes
www.openssh.org/releasenotes.htmlnvdRelease Notes
www.openwall.com/lists/oss-security/2026/07/06/5nvdMailing ListRelease Notes

News mentions

1

OpenSSH 10.4 Patches Six Vulnerabilities in Authentication and File Transfer Components
Vypr Intelligence · Jul 8, 2026