CVE-2026-56624
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Improper certificate validation in Apache MINA SSHD (server-side). The server did not check for force-command or verify-required options in OpenSSH certificates, allowing an authenticated user to execute other commands than specified. Fixed in versions 2.19.0 and 3.0.0-M5.
Risk Assessment
Risk involves bypassing command restrictions in certificates, which could lead to unauthorized command execution on the SSH server.
Recommendation
Immediately upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5.
Other vulnerabilities in Apache MINA SSHD
See all- CVE-2022-45047Critical
The class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD versions up to 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. It is one of several implementations that can be used for loading the host keys of an SSH server.
- CVE-2026-58624Medium
Vulnerability in Apache MINA SSHD (sshd-git component) allows an authenticated SSH user to execute arbitrary JGit commands, including writing files to arbitrary locations via `git archive --output`.
- CVE-2026-56623High
A path traversal vulnerability in the sshd-git component of Apache MINA SSHD on Windows allows an authenticated remote user to access git repositories outside the configured server root directory. The fix for CVE-2026-48827 was partially ineffective on Windows.
- CVE-2026-56452High
Path traversal vulnerability in the sshd-scp component of Apache MINA SSHD. A malicious sender can send filenames containing paths, allowing files to be written to arbitrary locations. Affects applications using SCP to receive files.
- CVE-2026-48827High
A path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git operations allows authenticated SSH users to access git repositories outside the configured git server root directory.
Original NVD description (English source)
Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*[email protected] user certificates (which are the only ones for which verify-required would make sense).