{"id":"CVE-2026-35386","title":"In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line","summary":"In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration…","severity":"low","cvss":3.6,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-696"],"vendor":"openbsd","product":"openssh","affected":["openssh >= 10.0, < 10.3"],"patched":["openssh 10.3"],"published":"2026-04-02","updated":"2026-07-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35386","references":[{"url":"https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2","label":"cve@mitre.org"},{"url":"https://www.openssh.org/releasenotes.html#10.3p1","label":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2026/04/02/3","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00319,"epssPercentile":0.24956,"ingestedAt":"2026-07-07T16:15:38.005Z","slug":"CVE-2026-35386","body":"## Overview\n\nIn OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.\n\n## Affected\n\n- `openssh >= 10.0, < 10.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssh 10.3`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":19.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}