CVE-2026-106584 Overview
CVE-2026-106584 affects ssh-keygen in OpenSSH versions prior to 10.6. The utility can generate certificates with incorrect expiration times due to improper handling of Daylight Saving Time transitions. The flaw stems from an off-by-one error [CWE-193] in time calculations. Users in specific Antarctic locations may experience a slightly more severe effect because of unusual local timezone behavior.
The vulnerability does not permit code execution, privilege escalation, or disclosure of sensitive data. The practical impact is limited to integrity of certificate validity windows, which can cause certificates to expire earlier or later than intended.
Critical Impact
Certificates issued by ssh-keygen may carry inaccurate expiration timestamps, potentially extending or shortening their intended validity period.
Affected Products
- OpenSSH versions prior to 10.6
- ssh-keygen certificate generation utility
- Systems using OpenSSH certificate authorities for SSH access control
Discovery Timeline
- 2026-10-06 - CVE-2026-106584 published to the National Vulnerability Database
- 2026-10-07 - Entry last updated in NVD
Technical Details for CVE-2026-106584
Vulnerability Analysis
The defect resides in how ssh-keygen computes certificate validity intervals when generating SSH certificates. Time arithmetic in the certificate generation path does not correctly account for Daylight Saving Time boundary transitions. As a result, the serialized valid before and valid after fields embedded in the certificate can drift by an hour relative to the operator's intent.
The weakness is classified as an off-by-one error [CWE-193]. Exploitation requires local access, high attack complexity, and user interaction, which keeps real-world risk low. The flaw does not grant an attacker any new capability over the host, the key material, or the SSH session itself.
Antarctic installations receive a special mention in the advisory because several Antarctic research stations follow unusual DST rules tied to supply-country timezones. Hosts configured for those zones can see somewhat larger offsets in the computed expiration.
Root Cause
The underlying issue is an off-by-one calculation when converting between local time and absolute certificate validity bounds across a DST boundary. The arithmetic treats the DST shift inconsistently, producing a validity window that is off by the DST offset.
Attack Vector
An attacker cannot directly trigger this condition remotely. The behavior manifests when an administrator legitimately runs ssh-keygen to mint a certificate with a validity window that spans a DST transition. The resulting certificate may be accepted or rejected outside the window the operator intended, which can create either a short grace period of unauthorized access or a premature lockout. See the OpenSSH 10.6 Release Notes for the upstream fix description.
Detection Methods for CVE-2026-106584
Indicators of Compromise
- SSH certificates whose valid before or valid after timestamps differ by exactly one hour from the operator-specified value.
- Authentication failures or unexpected successes clustered around DST transition dates for certificate-authenticated sessions.
- ssh-keygen -L -f <cert> output showing validity bounds that disagree with change-ticket records.
Detection Strategies
- Audit all SSH certificates issued by hosts running OpenSSH versions earlier than 10.6 and compare their embedded validity windows against the intended issuance parameters.
- Inventory the installed OpenSSH package version across Linux fleets and flag any host below 10.6 that acts as an SSH certificate authority.
Monitoring Recommendations
- Log and alert on SSH certificate issuance events, capturing the requested versus actual validity window.
- Track certificate-based authentication outcomes across DST transitions to surface anomalous expiry behavior.
- Correlate sshd authentication logs with certificate serial numbers to detect sessions accepted outside intended windows.
How to Mitigate CVE-2026-106584
Immediate Actions Required
- Upgrade OpenSSH to version 10.6 or later on all hosts that generate SSH certificates with ssh-keygen.
- Re-issue any certificates created near a DST boundary and verify the embedded validity window matches policy.
- Review certificate authority workflows that span DST transitions and confirm expiration dates post-upgrade.
Patch Information
The fix is included in OpenSSH 10.6. Refer to the OpenSSH 10.6 Release Notes for upstream commit details and distribution guidance. Operating system vendors typically backport OpenSSH fixes, so apply distribution security updates once available.
Workarounds
- Specify absolute UTC timestamps with ssh-keygen -V to avoid local time conversion ambiguity across DST boundaries.
- Set the system timezone to UTC on hosts used to issue SSH certificates until the patch is deployed.
- Avoid issuing certificates with validity windows that cross a DST transition on affected systems.
# Issue certificates using UTC absolute times to avoid DST drift
TZ=UTC ssh-keygen -s ca_key -I user_id -V "20260301000000:20270301000000" user_key.pub
# Verify the resulting validity window
ssh-keygen -L -f user_key-cert.pub
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
