CVE-2026-110925 in Red Hat
Summary
by MITRE • 10/15/2026
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in OpenSSH represents a critical input validation failure within the handling of username parameters during SSH connection establishment and execution contexts. Specifically, when a user specifies a username on the command line that includes special shell metacharacters such as dollar signs or non-trailing backslashes, these characters are not adequately sanitized before being processed by internal configuration expansion mechanisms. This flaw becomes particularly dangerous in scenarios where the OpenSSH client is configured to use ProxyCommand directives or Match exec rules that incorporate the %u placeholder for username substitution. In these configurations, the raw username string containing special characters is passed directly into a shell environment without proper escaping or validation, creating a pathway for arbitrary command execution by an attacker who can influence the input data.
From a technical perspective, this issue stems from insufficient parsing logic within the SSH client codebase when expanding variables in configuration files. The %u token is designed to be replaced with the authenticated username, but the implementation fails to account for shell injection vectors embedded within that string. When the resulting command line is executed via /bin/sh or a similar interpreter, characters like $ trigger variable expansion and backticks can initiate subshell execution if present, while unescaped backslashes may alter the interpretation of subsequent characters. This behavior violates fundamental security principles regarding input sanitization in shell-invoking applications, allowing an attacker to inject arbitrary commands that run with the privileges of the user executing the SSH client.
The operational impact of this vulnerability is severe, as it effectively allows for Remote Code Execution under specific configuration conditions. If a system administrator or automated process uses OpenSSH configurations involving ProxyCommand or Match exec statements and processes usernames from untrusted sources, an attacker could craft malicious username inputs to execute arbitrary commands on the host machine. This could lead to complete compromise of the affected system, including data exfiltration, installation of persistent backdoors, or lateral movement within a network if the compromised account has access to other resources. The risk is amplified in environments where SSH clients are used programmatically or through scripts that accept dynamic username inputs without rigorous validation.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection, and it also relates to CWE-20 Improper Input Validation regarding the failure to sanitize user-supplied data before processing. In terms of offensive security frameworks, this flaw facilitates techniques associated with ATT&CK T1059 Command and Scripting Interpreter, specifically through indirect command execution via shell metacharacters. The attack vector typically requires initial access to trigger the SSH connection or configuration evaluation, making it relevant in scenarios where attackers have obtained valid credentials or can manipulate input fields that feed into these specific OpenSSH features.
Mitigation strategies should prioritize updating OpenSSH to versions where this parsing logic has been corrected and special characters are properly escaped before shell execution. Administrators relying on ProxyCommand or Match exec directives with dynamic username inputs must implement strict validation layers outside of the SSH client itself, ensuring that only alphanumeric usernames without special symbols are accepted from untrusted sources. Additionally, reviewing configuration files to minimize reliance on %u expansion in contexts involving external command execution can reduce the attack surface. Regular security audits and penetration testing focusing on input handling in network service configurations remain essential practices for maintaining resilience against such injection-based vulnerabilities.