CVE Catalog
CVE-2026-59999
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.13%
3th percentile - higher than 3% of all known CVEs
Summary
In OpenSSH before version 10.4, the DisableForwarding=yes option did not override PermitTunnel=yes, allowing SSH tunneling despite forwarding being disabled.
Risk Assessment
The organization may be exposed to unauthorized SSH tunneling, potentially leading to data leakage or bypass of network security policies.
Recommendation
It is recommended to immediately update OpenSSH to version 10.4 or later, which fixes this vulnerability.
Original NVD description (English source)
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.