CVE-2026-48827
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git operations allows authenticated SSH users to access git repositories outside the configured git server root directory.
Risk Assessment
The organization risks unauthorized access to git repositories, potentially leading to source code and sensitive data leakage.
Recommendation
Update Apache MINA SSHD to version 2.18.0 (or 3.0.0-M4 for version 3.0.0) and implement additional access controls for repositories.
Other vulnerabilities in Apache MINA SSHD
See all- CVE-2026-94002High
Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD. The SFTP client implementation did not check that a received reply corresponded to a previously sent request, causing unsolicited replies to be stored but never consumed. A malicious server could send such replies until client memory is exhausted.
- CVE-2026-93996Medium
In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the ssd-scp component is vulnerable to uncontrolled resource consumption. The SCP protocol is line-oriented, and the handler did not impose a limit on line length. A malicious peer sending an endless sequence of characters without LF can cause memory allocation and application crash due to OutOfMemoryError.
- CVE-2026-93995Medium
In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-git component has improper input validation. The fix for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. Authenticated SSH clients can remotely execute git commands, including writing archives on the server.
- CVE-2026-93994High
Apache MINA SSHD allows partial authentication bypass. When the SSH server is configured to require two different public keys, the server code in component sshd-core does not enforce that the presented keys are different. A user can successfully authenticate by presenting the same key twice.
- CVE-2026-94053Critical
Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".
- CVE-2026-94052Critical
A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.
- CVE-2026-77185Critical
Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.
- CVE-2022-45047Critical
The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.
- CVE-2026-94029Medium
In Apache MINA SSHD versions 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-sftp component in the SFTP v6 check-file-name/check-file-handle extension is vulnerable to server-side memory exhaustion. Using a very small block size (e.g., 256) on a huge file generates many hashes, and the SFTP reply is accumulated in memory, potentially crashing the server.
- CVE-2026-58624Medium
Vulnerability in Apache MINA SSHD (sshd-git component) allows an authenticated SSH user to execute arbitrary JGit commands, including writing files to arbitrary locations via `git archive --output`.
Original NVD description (English source)
Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS