CVE Catalog
CVE-2026-35414
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk0.18%
7th percentile - higher than 7% of all known CVEs
Summary
OpenSSH before version 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
Risk Assessment
This vulnerability could allow unauthorized system access by bypassing key restrictions.
Recommendation
Update OpenSSH to version 10.3 or later.
Original NVD description (English source)
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.