CVE-2026-35386: OpenSSH RCE Vulnerability via Metacharacters

CVE-2026-35386 Overview

CVE-2026-35386 is a command injection vulnerability in OpenSSH versions prior to 10.3. The vulnerability allows command execution via shell metacharacters embedded in a username within a command line. Exploitation requires a specific scenario where the username on the command line is untrusted, combined with non-default configurations using the % token expansion in ssh_config.

Critical Impact

Attackers can achieve arbitrary command execution on systems with non-default OpenSSH configurations that process untrusted usernames through shell metacharacter injection.

Affected Products

• OpenSSH versions before 10.3
• OpenSSH portable versions before 10.3p1
• Systems using non-default % token configurations in ssh_config

Discovery Timeline

• 2026-04-02 - CVE-2026-35386 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-35386

Vulnerability Analysis

This vulnerability falls under CWE-696 (Incorrect Behavior Order) and represents a command injection flaw in OpenSSH's handling of username parameters. The issue arises when OpenSSH processes usernames containing shell metacharacters in command-line arguments, particularly when the ssh_config file uses % token expansion directives.

When a system administrator configures OpenSSH with percent token expansions (such as %u for username or %h for hostname) in directives like ProxyCommand, LocalCommand, or similar configuration options, the username provided on the command line may be interpolated into shell commands without proper sanitization. This allows an attacker who controls the username input to inject arbitrary shell commands.

The vulnerability requires specific preconditions: the username must originate from an untrusted source, and the OpenSSH configuration must employ % token expansion in a way that passes user-controlled data to a shell context. While these conditions limit the attack surface, environments that meet these criteria are exposed to potential command execution.

Root Cause

The root cause is improper sanitization of shell metacharacters in username parameters before they are processed through % token expansion in ssh_config directives. When configuration options like ProxyCommand or LocalCommand use %u (username) or similar tokens, the expanded values are passed to the shell for execution. If the username contains metacharacters such as ;, |, $(), or backticks, these can break out of the intended command context and execute arbitrary commands.

Attack Vector

The attack requires local access and involves an attacker providing a maliciously crafted username containing shell metacharacters when initiating an SSH connection. The attack exploits the token expansion mechanism in non-default ssh_config configurations.

For example, if an administrator has configured a ProxyCommand directive that uses %u for username expansion, an attacker could craft a username like user$(malicious_command) or user;malicious_command; to inject commands that execute when the SSH client processes the connection request.

The vulnerability mechanism involves the following sequence:

1. User provides a malicious username via command line to the SSH client
2. OpenSSH reads ssh_config containing % token expansion directives
3. The username is expanded within shell command contexts without proper escaping
4. Shell metacharacters in the username are interpreted, allowing command injection

Technical details and discussion can be found in the OpenSSH Development Discussion and Openwall OSS Security Mailing List.

Detection Methods for CVE-2026-35386

Indicators of Compromise

• Unusual SSH client process spawning unexpected child processes
• SSH connection attempts with usernames containing shell metacharacters (;, |, $, backticks, &)
• Suspicious command execution patterns originating from SSH client processes
• Log entries showing malformed or unusual username patterns in authentication attempts

Detection Strategies

• Monitor SSH client command-line arguments for usernames containing shell metacharacters
• Audit ssh_config files for usage of % token expansion in potentially dangerous directives such as ProxyCommand, LocalCommand, PermitLocalCommand, and similar options
• Implement endpoint detection rules to identify process trees where SSH clients spawn unexpected shell commands
• Review system logs for SSH connections with unusual username patterns

Monitoring Recommendations

• Enable verbose SSH logging to capture connection details including usernames
• Deploy file integrity monitoring on ssh_config and ~/.ssh/config files to detect unauthorized modifications
• Monitor for process creation events where SSH client binaries spawn shell processes with unexpected arguments
• Implement network-level monitoring for SSH connections with anomalous username formats

How to Mitigate CVE-2026-35386

Immediate Actions Required

• Upgrade OpenSSH to version 10.3 or 10.3p1 or later immediately
• Audit all ssh_config and user-level SSH configuration files for % token usage
• Review and restrict sources of untrusted username input in automated SSH connection scripts
• Consider removing or sanitizing %u and similar user-controlled token expansions from configuration files until patching is complete

Patch Information

OpenSSH has addressed this vulnerability in version 10.3 and 10.3p1. The patch implements proper escaping and sanitization of shell metacharacters in username parameters before they are processed through % token expansion. Detailed release information is available in the OpenSSH Release Notes 10.3p1.

Organizations should update to the patched version through their distribution's package manager or compile from source. Verify the installed version after patching using ssh -V.

Workarounds

• Remove % token expansions that reference user-controlled values (such as %u) from ProxyCommand, LocalCommand, and similar directives in ssh_config
• Implement input validation on any automated systems that pass usernames to SSH commands, rejecting usernames containing shell metacharacters
• Use wrapper scripts that sanitize username inputs before passing them to SSH client commands
• Restrict SSH client configurations to use only trusted, hardcoded values rather than dynamic token expansions

# Configuration example
# Review and modify ssh_config to avoid dangerous % expansions
# Before (potentially vulnerable):
# Host example
#     ProxyCommand /usr/bin/nc -x proxy:1080 %h %p -u %u

# After (safer configuration using static values):
# Host example
#     ProxyCommand /usr/bin/nc -x proxy:1080 %h %p

# Verify OpenSSH version after upgrade
ssh -V
# Expected output: OpenSSH_10.3p1 or higher