---
id: CVE-2026-35386
title: >-
  In OpenSSH before 10.3, command execution can occur via shell metacharacters
  in a username within a command line
summary: >-
  In OpenSSH before 10.3, command execution can occur via shell metacharacters
  in a username within a command line. This requires a scenario where the
  username on the command line is untrusted, and also requires a non-default
  configuration…
severity: low
cvss: 3.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-696
vendor: openbsd
product: openssh
affected:
  - 'openssh >= 10.0, < 10.3'
patched:
  - openssh 10.3
published: '2026-04-02'
updated: '2026-07-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35386'
references:
  - url: 'https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2'
    label: cve@mitre.org
  - url: 'https://www.openssh.org/releasenotes.html#10.3p1'
    label: cve@mitre.org
  - url: 'https://www.openwall.com/lists/oss-security/2026/04/02/3'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00356
epssPercentile: 0.26559
ingestedAt: '2026-07-07T16:15:38.005Z'
---

## Overview

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

## Affected

- `openssh >= 10.0, < 10.3`

## Remediation

Upgrade past the affected range:

- `openssh 10.3`