CVE-2026-110928 - Vulnerability Details - OpenCVE

A flaw was found in OpenSSH. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Openssh	Openssh

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-110928
https://www.cve.org/CVERecord?id=CVE-2026-110928

History

Sat, 17 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openssh Openssh openssh
Vendors & Products		Openssh Openssh openssh

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in OpenSSH. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel.
Title		openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
Weaknesses		CWE-284
References		https://nvd.nist.gov/vuln/detail/CVE-2026-110928 https://www.cve.org/CVERecord?id=CVE-2026-110928
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}` threat_severity `Moderate`

MITRE

No data.

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-10-15T00:00:00Z

Links: CVE-2026-110928 - Bugzilla

{"bugzilla": {"description": "openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding", "id": "2553038", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553038"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-284", "details": ["A flaw was found in OpenSSH. The authorized_keys \"restrict\" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel."], "mitigation": {"lang": "en:us", "value": "No mitigation is required for Red Hat Enterprise Linux. On other builds, keep PermitTunnel set to no."}, "name": "CVE-2026-110928", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "openshell", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "openssh", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110928\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110928"], "statement": "Red Hat Enterprise Linux is not affected. The downstream patch for CVE-2026-59999 is stricter than the upstream OpenSSH 10.6 fix for this tunnel restriction. PermitTunnel is disabled by default.", "threat_severity": "Moderate"}