CVE-2026-106587: OpenSSH Information Disclosure Vulnerability

CVE-2026-106587 Overview

CVE-2026-106587 affects OpenSSH versions before 10.6. The sshd daemon sometimes interprets the configuration value none as a literal filename rather than as a sentinel meaning the feature is disabled. This type-confusion flaw [CWE-843] can lead to unexpected file access or feature behavior that administrators did not intend when configuring the SSH daemon.

The issue requires local access and low privileges to exploit, with high attack complexity. Confidentiality impact is absent, while integrity and availability impacts are low. The OpenSSH project addressed the issue in release 10.6.

Critical Impact
Configuration options set to none may be processed as a filename by sshd, bypassing the intended disabled state and producing unintended runtime behavior on affected hosts.

Affected Products

OpenSSH sshd versions before 10.6
Unix and Linux distributions bundling pre-10.6 OpenSSH
Appliances and container images embedding vulnerable OpenSSH builds

Discovery Timeline

2026-10-06 - CVE-2026-106587 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106587

Vulnerability Analysis

The vulnerability resides in how sshd parses certain configuration directives. In OpenSSH configuration syntax, the literal string none is widely used to indicate that a specific feature should be disabled. For some options, however, the parser treats none as the name of a file to open or reference. This inconsistency is a classic Type Confusion weakness [CWE-843].

When sshd processes the directive, it may attempt filesystem operations against a path literally named none instead of skipping the configured behavior. The result is that administrators who believed they had disabled a feature can find the daemon still acting on configuration data derived from an unintended source.

The advisory classifies the issue as local in attack vector with high complexity. An attacker requires existing low-privilege access and must contend with specific configuration preconditions to influence behavior. See the OpenSSH Release Notes 10.6 for the upstream description.

Root Cause

The root cause is inconsistent handling of the sentinel value none across configuration option parsers in sshd. One code path treats none as a disabling keyword while another treats it as a filesystem path, producing divergent behavior for the same input token.

Attack Vector

Exploitation requires local access to the system and depends on administrator configuration choices. An attacker who can place or control a file named none in a path consulted by sshd may influence daemon behavior. The vulnerability does not permit remote exploitation and does not expose confidential data, but it can affect integrity and availability of the SSH service.

No verified public exploit code is available for CVE-2026-106587. Refer to the upstream advisory for authoritative technical details.

Detection Methods for CVE-2026-106587

Indicators of Compromise

Presence of a file literally named none in directories referenced by sshd such as the working directory of the daemon or configured key, banner, or authorized-keys paths.
sshd log entries referencing successful opens or reads of a path named none when the administrator intended the feature to be disabled.
Unexpected behavior of SSH options the administrator believed were disabled through the none keyword.

Detection Strategies

Audit sshd_config and any Match blocks for directives set to none and compare observed daemon behavior against expected disabled state.
Run sshd -T to dump the effective configuration and verify no option resolves to a filename literally named none.
Inventory installed OpenSSH versions across the fleet and flag any host running a build earlier than 10.6.

Monitoring Recommendations

Monitor filesystem events for creation of files named none in directories read by sshd and alert on anomalies.
Forward sshd logs to a central SIEM and build detections for configuration-parse warnings or file-open events referencing the string none.
Track OpenSSH package versions through endpoint telemetry and alert when hosts drift below the fixed release.

How to Mitigate CVE-2026-106587

Immediate Actions Required

Upgrade OpenSSH to version 10.6 or later on all affected systems.
Review every sshd_config directive that uses the value none and confirm the resulting behavior matches intent.
Remove any filesystem artifacts named none from directories consulted by sshd.
Restrict local account access on hosts running SSH to reduce the attacker population capable of triggering the condition.

Patch Information

The OpenSSH project fixed the inconsistency in release 10.6. Operators should install the vendor-supplied package update for their distribution or compile from upstream sources. Refer to the OpenSSH Release Notes 10.6 for the complete change list.

Workarounds

If immediate patching is not feasible, replace none values in sshd_config with explicit directives that unambiguously disable the feature or omit the directive entirely to rely on defaults.
Enforce strict permissions on directories referenced by sshd to prevent unauthorized creation of files named none.
Limit local shell access on SSH servers to trusted administrators until the patch is applied.

bash

# Validate effective sshd configuration and search for 'none' values
sudo sshd -T | grep -i '\bnone\b'

# Confirm installed OpenSSH version meets or exceeds 10.6
ssh -V

# Remove unintended file literally named 'none' from the sshd runtime directory
sudo find /etc/ssh /var/lib/ssh -maxdepth 2 -type f -name 'none' -print