CVE-2026-106589 Overview
CVE-2026-106589 affects OpenSSH through version 10.6 on specific legacy platforms. In environments such as QNX 6 and SCO OpenServer 5, the sshd-session process can unexpectedly retain root privileges. The issue relates to the GatewayPorts and StreamLocalForwarding configuration options, combined with the absence of file-descriptor passing and unprivileged pseudo-terminal (PTY) allocation support on these platforms. The flaw is categorized under [CWE-272] Least Privilege Violation.
Critical Impact
On affected legacy Unix-like systems, sshd-session runs with elevated privileges that should have been dropped, weakening the privilege-separation model that OpenSSH relies on.
Affected Products
- OpenSSH versions through 10.6
- QNX 6 deployments running vulnerable OpenSSH builds
- SCO OpenServer 5 deployments running vulnerable OpenSSH builds
Discovery Timeline
- 2026-10-06 - CVE-2026-106589 published to the National Vulnerability Database (NVD)
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-106589
Vulnerability Analysis
OpenSSH uses privilege separation to limit the exposure of root-owned processes during session handling. The sshd-session component is intended to run with reduced privileges after authentication. On QNX 6 and SCO OpenServer 5, the operating system lacks two primitives that OpenSSH depends on: file-descriptor passing between processes and unprivileged allocation of PTY devices.
When GatewayPorts or StreamLocalForwarding are configured, OpenSSH requires elevated capabilities to bind ports or create UNIX-domain sockets on behalf of the session. On platforms without the expected privilege-handling primitives, sshd-session continues running as root instead of transitioning to the user context.
The attack is local, requires high attack complexity, and does not require authentication for the privilege-separation weakness itself to be present. Impact is limited to integrity, with no direct confidentiality or availability compromise.
Root Cause
The root cause is a platform-conditional least-privilege violation [CWE-272]. OpenSSH's privilege-drop paths assume the operating system provides file-descriptor passing over UNIX sockets and unprivileged PTY allocation. QNX 6 and SCO OpenServer 5 do not meet those assumptions, so sshd-session keeps root privileges when forwarding or gateway features are enabled.
Attack Vector
An attacker with local access to an affected QNX 6 or SCO OpenServer 5 host can interact with a sshd-session process that holds unexpected root privileges. Exploitation depends on specific sshd_config settings, specifically GatewayPorts and StreamLocalForwarding, being enabled on the server. Successful abuse could allow a local actor to influence session-handling behavior that was intended to execute under a reduced-privilege context.
No verified proof-of-concept code is published for this issue. The vulnerability mechanism is described in the OpenSSH Release Notes 10.6.
Detection Methods for CVE-2026-106589
Indicators of Compromise
- sshd-session processes observed running as uid=0 after session establishment on QNX 6 or SCO OpenServer 5 hosts.
- Local sessions interacting with port-forwarded listeners bound by a root-owned sshd-session when a non-root user initiated the connection.
- Unexpected UNIX-domain sockets created by sshd-session with root ownership tied to user forwarding requests.
Detection Strategies
- Audit sshd_config across QNX 6 and SCO OpenServer 5 hosts for GatewayPorts or StreamLocalForwarding set to any value other than no.
- Enumerate running sshd-session processes and compare effective UID against the authenticated session owner.
- Review OpenSSH version strings on legacy Unix hosts and flag any build at or below 10.6.
Monitoring Recommendations
- Forward authentication and process-creation telemetry from legacy Unix hosts into a centralized analytics platform for UID-mismatch analysis.
- Alert on configuration drift that enables GatewayPorts or StreamLocalForwarding on hosts running OpenSSH 10.6 or earlier.
- Track local privilege-use patterns on QNX 6 and SCO OpenServer 5 systems where OpenSSH is exposed to multi-user workloads.
How to Mitigate CVE-2026-106589
Immediate Actions Required
- Inventory all QNX 6 and SCO OpenServer 5 systems running OpenSSH and identify builds at version 10.6 or earlier.
- Disable GatewayPorts and StreamLocalForwarding in sshd_config on affected hosts until a patched build is deployed.
- Restrict local shell access on affected systems to trusted administrators to reduce exposure to local attack vectors.
Patch Information
Refer to the OpenSSH Release Notes 10.6 for upstream fix details and upgrade guidance. Rebuild or reinstall OpenSSH from a release that addresses the platform-specific privilege-separation gap on QNX 6 and SCO OpenServer 5.
Workarounds
- Set GatewayPorts no and StreamLocalForwarding no in sshd_config on affected hosts and reload the service.
- Remove or disable OpenSSH on QNX 6 and SCO OpenServer 5 hosts where forwarding features cannot be turned off.
- Enforce host-level access controls that prevent untrusted local users from reaching the SSH service on affected platforms.
# Configuration example: harden sshd_config on affected legacy hosts
GatewayPorts no
StreamLocalForwarding no
# Reload sshd after editing /etc/ssh/sshd_config
# (service manager varies by platform)
kill -HUP $(cat /var/run/sshd.pid)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
