CVE-2026-59999

A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.

This Moderate severity flaw in OpenSSH sshd allows PermitTunnel=yes to override DisableForwarding=yes, potentially bypassing intended security controls. In Red Hat environments where DisableForwarding is used to restrict SSH session capabilities, an attacker who compromises a user's session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though PermitTunnel is not enabled by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if DisableForwarding=yes is set in /etc/ssh/sshd_config to prevent all forwarding, ensure that PermitTunnel is explicitly set to no in the same configuration file. This will enforce the intended security policy.

After modifying /etc/ssh/sshd_config, restart the sshd service for the changes to take effect. This may temporarily interrupt active SSH sessions.