CVE-2026-35386 is a low-severity vulnerability in OpenSSH versions prior to 10.3, enabling command execution via shell metacharacters in an untrusted username provided on the command line. Exploitation requires a specific non-default configuration of '%' in ssh_config and is characterized by high attack complexity and a local attack vector. With a CVSS score of 3.6 (Low), the potential impact is limited to low confidentiality and integrity. There is no public exploit code available, it is not listed in CISA's KEV catalog, and while it has received some community discussion, active exploitation has not been reported.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.0, < 10.3CPE matchmatch criteria | cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* | ||
>= 0, < 10.3CPE match | cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OpenSSH vulnerabilities
Apr 29, 2026In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
Apr 2, 2026