CVE-2026-106586: OpenSSH Privilege Escalation Vulnerability

CVE-2026-106586 Overview

CVE-2026-106586 affects sshd in OpenSSH versions prior to 10.6. The restrict keyword in authorized_keys was documented to apply to tunnel forwarding but was not enforced for that function. A local authenticated attacker with a key marked as restrict can still establish tunnel forwarding, bypassing an intended restriction. This issue is distinct from CVE-2026-73283, which affects a different code path. The vulnerability maps to [CWE-670] (Always-Incorrect Control Flow Implementation). OpenSSH released version 10.6 to correct the enforcement logic.

Critical Impact
Keys configured with restrict in authorized_keys can still negotiate tunnel forwarding, undermining the principal-of-least-privilege policy administrators expect from that keyword.

Affected Products

OpenSSH sshd versions before 10.6
Systems that rely on the restrict keyword in authorized_keys to limit per-key capabilities
Linux, BSD, and Unix distributions bundling pre-10.6 OpenSSH server builds

Discovery Timeline

2026-10-06 - CVE-2026-106586 published to the National Vulnerability Database
2026-10-06 - Entry last modified in NVD
OpenSSH 10.6 - Upstream release notes document the corrected behavior

Technical Details for CVE-2026-106586

Vulnerability Analysis

The restrict keyword in authorized_keys is a shorthand that disables agent forwarding, port forwarding, PTY allocation, user rc execution, and X11 forwarding for a specific key. According to the OpenSSH 10.6 release notes, the keyword was intended to also block tunnel device forwarding, which is requested through the SSH tun@openssh.com channel type. The enforcement check was missing from the tunnel forwarding path.

As a result, a user who authenticated with a restricted key could still request a tun device via ssh -w. The impact is confined to the local attack surface because the user must already hold a valid key and reach sshd. Confidentiality is not affected, but integrity is partially impacted because the authenticated session gains a network capability the administrator intended to deny.

Root Cause

The root cause is an incomplete option enforcement in the server-side authorization code. The restrict modifier set the expected permission flags for shell, port, X11, and agent features but did not clear the permit_tun capability. The tunnel request handler consulted only the per-key tunnel flag, so the server granted the channel.

Attack Vector

Exploitation requires local-adjacent conditions: valid credentials for an account whose authorized_keys entry uses restrict, network reachability to sshd, and server-side support for PermitTunnel. The attacker connects with ssh -w to request a tun or tap device. Successful negotiation yields a point-to-point interface the operator did not sanction. The vulnerability does not grant code execution or data disclosure on its own. No public proof-of-concept or in-the-wild exploitation has been reported. See the OpenSSH 10.6 release notes for upstream details.

Detection Methods for CVE-2026-106586

Indicators of Compromise

Unexpected tun or tap interfaces appearing on hosts that run sshd
sshd log entries referencing tun@openssh.com channel requests from accounts whose keys use restrict
Outbound SSH client invocations containing -w flags originating from service or automation accounts

Detection Strategies

Audit authorized_keys files for restrict entries and correlate with sshd channel-open events for tun@openssh.com
Enable LogLevel VERBOSE in sshd_config to capture channel type negotiations and key fingerprints used for authentication
Review the server-side PermitTunnel setting; if disabled globally, the vulnerability has no practical effect

Monitoring Recommendations

Forward sshd authentication and channel logs to a centralized log platform for retention and query
Alert on creation of new tun/tap devices on servers that do not operate as VPN concentrators
Baseline the set of accounts permitted to request tunnels and alert on deviations

How to Mitigate CVE-2026-106586

Immediate Actions Required

Upgrade sshd to OpenSSH 10.6 or later, or apply the distribution-provided backport
Set PermitTunnel no in sshd_config on hosts that do not require SSH tunnel devices
Review every authorized_keys entry that uses restrict and confirm that tunnel forwarding is actually denied after patching

Patch Information

OpenSSH 10.6 contains the corrected enforcement for the restrict keyword in authorized_keys. Administrators should track vendor advisories from their Linux or BSD distribution for backported fixes. Reference: OpenSSH Release Notes 10.6.

Workarounds

Disable tunnel forwarding globally with PermitTunnel no in sshd_config until the patched release is deployed
Add an explicit permitopen="" and no-port-forwarding set alongside restrict to narrow residual capabilities
Restrict sshd access via firewall rules so only known management hosts can reach port 22

bash

# /etc/ssh/sshd_config - deny tunnel forwarding server-wide
PermitTunnel no

# Reload the service after editing
sudo sshd -t && sudo systemctl reload sshd