CVE-2026-106583 - Vulnerability Details - OpenCVE

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Openbsd	Openssh

Configuration 1 [-]

cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-106583
https://www.cve.org/CVERecord?id=CVE-2026-106583
https://www.openssh.org/releasenotes.html#10.6

History

Tue, 20 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Title	Command Injection via Special Characters in Command-Line Username	openssh: openssh: Command injection via unvalidated command-line username
Weaknesses		CWE-78
References		https://nvd.nist.gov/vuln/detail/CVE-2026-106583 https://www.cve.org/CVERecord?id=CVE-2026-106583
Metrics	threat_severity `None`	threat_severity `Low`

Thu, 15 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 07 Oct 2026 01:15:00 +0000

Type	Values Removed	Values Added
Title		Command Injection via Special Characters in Command-Line Username

Tue, 06 Oct 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
First Time appeared		Openbsd Openbsd openssh
Weaknesses		CWE-99
CPEs		cpe:2.3:a:openbsd:openssh::::::::
Vendors & Products		Openbsd Openbsd openssh
References		https://www.openssh.org/releasenotes.html#10.6
Metrics		cvssV3_1 `{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-10-06T23:42:14.374Z

Updated: 2026-10-15T18:10:20.766Z

Reserved: 2026-10-06T20:40:38.396Z

Link: CVE-2026-106583

Vulnrichment

Updated: 2026-10-15T16:10:57.699Z

NVD

Status : Analyzed

Published: 2026-10-07T00:17:20.743

Modified: 2026-10-15T19:17:18.523

Link: CVE-2026-106583

Redhat

Severity : Low

Publid Date: 2026-10-06T23:42:14Z

Links: CVE-2026-106583 - Bugzilla

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSH", "vendor": "OpenBSD", "versions": [{"lessThan": "10.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "09209468-5A53-45C0-8698-8C668E53EBEA", "versionEndExcluding": "10.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection."}], "id": "CVE-2026-106583", "lastModified": "2026-10-15T19:17:18.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106583", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T16:10:54.270923Z", "version": "2.0.3"}}]}, "published": "2026-10-07T00:17:20.743", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.openssh.org/releasenotes.html#10.6"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-99"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openssh: openssh: Command injection via unvalidated command-line username", "id": "2547243", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547243"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-78", "details": ["In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through shell-evaluated options such as ProxyCommand, potentially leading to arbitrary command execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-106583", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openssh", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T23:42:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106583\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106583\nhttps://www.openssh.org/releasenotes.html#10.6"], "statement": "A low-impact command injection flaw was found in the OpenSSH client. The ssh client did not restrict '$' and '\\' characters in usernames supplied on the command line. When an application or wrapper script passes an attacker-controlled username to the ssh command line and the client configuration evaluates shell commands that expand the username, such as ProxyCommand or Match exec, an attacker could inject and execute arbitrary shell commands in the context of the local user. Red Hat Product Security rates this flaw Low severity (CVSS 3.1 score of 2.5) because exploitation requires local invocation of the ssh client with an attacker-controlled username together with a non-default configuration that expands the username in a shell context, limiting the impact to the integrity of the local user's session; this differs from the NVD severity of 7.8, which assumes no privileges are required and a full compromise of confidentiality, integrity, and availability. Within Red Hat's portfolio, only the openssh package in Red Hat Hardened Images (hummingbird-1) is affected, and a fix for that product is being pursued through its delegated update stream.", "threat_severity": "Low"}