CVE-2026-35385: OpenSSH Privilege Escalation Vulnerability

CVE-2026-35385 Overview

A file permission vulnerability exists in OpenSSH before version 10.3 that affects the scp file transfer utility. When downloading files as root using the legacy SCP protocol (-O flag) without the preserve mode flag (-p), downloaded files may unexpectedly retain setuid or setgid permissions. This behavior contradicts expected security practices where privileged file permissions should be stripped during transfers, potentially allowing privilege escalation if malicious files are downloaded and subsequently executed.

Critical Impact

Files downloaded via SCP as root may retain dangerous setuid/setgid permissions, enabling local privilege escalation if malicious binaries are transferred and executed on the target system.

Affected Products

• OpenSSH versions before 10.3
• Systems using SCP with legacy protocol mode (-O flag)
• Environments performing SCP transfers as root without preserve mode (-p)

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-35385 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-35385

Vulnerability Analysis

This vulnerability falls under CWE-281 (Improper Preservation of Permissions) and represents an improper permissions handling flaw in OpenSSH's SCP implementation. The issue specifically manifests when root users utilize the legacy SCP protocol without enabling preserve mode.

The core problem lies in how the SCP client handles file permission bits during downloads. Under normal circumstances, security-conscious systems should strip dangerous permission bits like setuid (SUID) and setgid (SGID) from downloaded files to prevent privilege escalation attacks. However, when the -O flag is used to invoke the legacy SCP protocol and the -p flag is omitted, OpenSSH fails to properly sanitize these permission bits.

The network-based attack requires user interaction since an administrator must actively perform the SCP transfer with the vulnerable configuration. However, the potential impact is severe—an attacker who can control files on a remote server could craft malicious setuid binaries that, when downloaded by a privileged user, would execute with elevated privileges.

Root Cause

The vulnerability stems from improper permission preservation logic in OpenSSH's legacy SCP protocol implementation. When transferring files using the -O (legacy protocol) flag, the SCP client copies file permissions from the remote source without adequately filtering setuid and setgid bits. The absence of the -p (preserve mode) flag should trigger default permission handling that strips these dangerous bits, but the implementation fails to do so in this specific scenario.

Attack Vector

The attack requires the following conditions to be present:

1. A victim administrator performs an SCP download operation as the root user
2. The -O flag is specified to use the legacy SCP protocol
3. The -p flag is NOT used (no explicit preserve mode)
4. The attacker controls the source file on the remote server and has set malicious setuid/setgid permissions
5. The downloaded file is subsequently executed on the target system

A successful exploitation would result in the attacker's malicious binary executing with elevated privileges (root if setuid-root), potentially leading to complete system compromise.

Detection Methods for CVE-2026-35385

Indicators of Compromise

• Presence of unexpected setuid/setgid binaries in directories commonly used for SCP downloads
• System logs showing SCP transfers executed as root with the -O flag
• Newly created executable files with the 4755 or 2755 permission modes in user-writable locations
• Process execution traces showing privilege escalation from recently downloaded files

Detection Strategies

• Monitor scp command executions for the combination of root privilege, -O flag, and absence of -p flag
• Implement file integrity monitoring to detect unexpected setuid/setgid files appearing on the system
• Configure audit rules to log all file permission changes involving setuid or setgid bits
• Review SSH and SCP logs for downloads performed with legacy protocol mode

Monitoring Recommendations

• Enable auditd rules to track chmod, chown, and file creation events involving special permission bits
• Deploy endpoint detection to alert on SCP operations performed as root with the vulnerable flag combination
• Regularly scan the filesystem for setuid/setgid binaries and compare against a known-good baseline
• Monitor for unusual process privilege elevations that may indicate exploitation of downloaded malicious binaries

How to Mitigate CVE-2026-35385

Immediate Actions Required

• Upgrade OpenSSH to version 10.3 or later where this vulnerability has been addressed
• Avoid running SCP transfers as root whenever possible; use non-privileged accounts
• When root SCP transfers are necessary, always include the -p flag to invoke proper permission handling
• Discontinue use of the legacy SCP protocol (-O flag) in favor of the modern SFTP-based implementation

Patch Information

OpenSSH has released version 10.3p1 which addresses this permission handling vulnerability. Organizations should update to this version or later as soon as possible. Detailed information about the fix can be found in the OpenSSH Release Notes 10.3p1.

Additional technical discussion is available on the OpenSSH Development Discussion mailing list and the Openwall OSS-Security Mailing List Update.

Workarounds

• Always use the -p flag when performing SCP transfers as root to ensure proper permission handling
• Avoid using the legacy SCP protocol (-O flag) and instead rely on the default SFTP-based transfer mechanism
• Implement post-transfer scripts that automatically strip setuid/setgid bits from downloaded files
• Use rsync or sftp as alternatives to SCP for secure file transfers that need proper permission handling

# Configuration example
# Safer SCP usage - always include -p flag when transferring as root
scp -p user@remote:/path/to/file /local/destination/

# Post-download permission sanitization
find /download/directory -type f \( -perm -4000 -o -perm -2000 \) -exec chmod ug-s {} \;

# Use SFTP instead of legacy SCP protocol
sftp user@remote:/path/to/file /local/destination/