CVE-2026-106583

A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through shell-evaluated options such as ProxyCommand, potentially leading to arbitrary command execution.

A low-impact command injection flaw was found in the OpenSSH client. The ssh client did not restrict '$' and '' characters in usernames supplied on the command line. When an application or wrapper script passes an attacker-controlled username to the ssh command line and the client configuration evaluates shell commands that expand the username, such as ProxyCommand or Match exec, an attacker could inject and execute arbitrary shell commands in the context of the local user. Red Hat Product Security rates this flaw Low severity (CVSS 3.1 score of 2.5) because exploitation requires local invocation of the ssh client with an attacker-controlled username together with a non-default configuration that expands the username in a shell context, limiting the impact to the integrity of the local user's session; this differs from the NVD severity of 7.8, which assumes no privileges are required and a full compromise of confidentiality, integrity, and availability. Within Red Hat's portfolio, only the openssh package in Red Hat Hardened Images (hummingbird-1) is affected, and a fix for that product is being pursued through its delegated update stream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.