CVE-2026-106589

A flaw was found in OpenSSH. This vulnerability may allow privilege escalation on operating systems that lack support for file-descriptor passing and unprivileged terminal device allocation. In these environments, the session process unexpectedly retains administrative (root) privileges after user authentication. When port or socket forwarding features are enabled, an authenticated user can exploit these retained permissions to perform unauthorized privileged actions.

A LOW impact flaw was found in OpenSSH. On operating systems that lack support for file-descriptor passing and that require root privileges for PTY allocation — such as QNX 6 and SCO OpenServer 5, or builds where file-descriptor passing was disabled at build time — the post-authentication sshd-session process unexpectedly retains root privileges instead of running with the privileges of the logged-in user. In that situation, an authenticated user can use the port and socket forwarding features controlled by the GatewayPorts and StreamLocalForwarding options to circumvent controls that would normally apply to that user, for example making unix-domain socket connections or binding to low-numbered TCP ports, resulting in privilege escalation. Red Hat Product Security rates this flaw as LOW impact (CVSS:3.1 score 2.9, consistent with the upstream rating) because exploitation requires an authenticated session on one of the affected platforms with the relevant forwarding features enabled. Platforms that support file-descriptor passing and unprivileged PTY allocation are not exposed to this issue. The only in-scope Red Hat product affect, the openssh package in Red Hat Hardened Images (Hummingbird), was assessed by the delegated team as NOTAFFECTED and its tracker was closed as Not a Bug because the vulnerable code is not present; consequently no fix is being pursued for Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.