CVE-2026-56623: Apache MINA SSHD Path Traversal Flaw

CVE-2026-56623 Overview

CVE-2026-56623 is a path traversal vulnerability in the Apache MINA SSHD sshd-git component when running on Windows. Apache MINA SSHD is a Java library that implements client-side and server-side SSH functionality. Authenticated remote users can access Git repositories located outside the configured server-side root directory. The flaw exists because the path validation added for CVE-2026-48827 in versions 2.18.0 and 3.0.0-M4 remained partly ineffective on Windows hosts. Only applications using org.apache.sshd:sshd-git to implement a Git server on Windows are affected. The Apache MINA project has released fixed versions 2.19.0 and 3.0.0-M5.

Critical Impact
Authenticated SSH users can traverse outside the configured Git repository root on Windows servers, exposing repositories that should remain isolated.

Affected Products

Apache MINA SSHD sshd-git component versions up to and including 2.18.0 running on Windows
Apache MINA SSHD pre-release milestones 3.0.0-M1 through 3.0.0-M4 running on Windows
Git server applications built with org.apache.sshd:sshd-git on the Windows platform

Discovery Timeline

2026-07-20 - CVE-2026-56623 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-56623

Vulnerability Analysis

The vulnerability is a path traversal flaw classified under [CWE-22]. It allows an authenticated SSH client to reach Git repositories outside the intended root directory served by sshd-git. Apache MINA SSHD previously received a fix for a related traversal issue tracked as CVE-2026-48827. That fix normalized and validated repository paths against the configured root. On Windows, the earlier validation logic did not fully account for platform-specific path semantics. Attackers with valid SSH credentials can therefore reach unauthorized repositories on the host file system.

Root Cause

The root cause is incomplete platform-aware path normalization in the Git repository resolution logic. Windows supports multiple path separators, drive-letter prefixes, UNC paths, and reserved device names. The validation applied for CVE-2026-48827 did not fully canonicalize these Windows-specific constructs before comparing against the allowed root directory. As a result, crafted repository paths bypass the check and resolve to locations outside the intended boundary.

Attack Vector

Exploitation requires an authenticated SSH session to the affected sshd-git server. The attacker issues Git protocol requests referencing repository paths containing traversal sequences valid under Windows path parsing. The server accepts the request, resolves the path outside the configured root, and returns repository contents. The vulnerability has network attack vector and requires low privileges, with high confidentiality impact and low integrity impact.

No verified public proof-of-concept code is available. See the Apache Security Mailing List Post for the vendor advisory.

Detection Methods for CVE-2026-56623

Indicators of Compromise

SSH sessions from authenticated users issuing Git commands referencing paths containing ..\, ../, drive-letter prefixes (C:\), or UNC prefixes (\\)
Access log entries showing repository resolutions to file system locations outside the configured sshd-git root directory
Unexpected read activity on Git repositories or files not owned by the requesting user account

Detection Strategies

Review sshd-git server logs for repository path arguments containing Windows-style traversal patterns or absolute path prefixes
Correlate authenticated SSH sessions with file system access events on the Windows host to identify reads outside the intended repository root
Inventory Java applications on Windows for the org.apache.sshd:sshd-git dependency at versions ≤ 2.18.0 or 3.0.0-M1 through 3.0.0-M4

Monitoring Recommendations

Enable verbose logging of Git command arguments and resolved repository paths on all sshd-git servers
Alert on file access events where the resolved path is outside the parent directory configured as the Git root
Track SSH authentication events and correlate them with subsequent Git repository access for anomaly review

How to Mitigate CVE-2026-56623

Immediate Actions Required

Upgrade org.apache.sshd:sshd-git to version 2.19.0 on all production Windows Git servers
Upgrade pre-release deployments using the 3.0.0 milestone line to 3.0.0-M5
Audit existing SSH user accounts and revoke credentials that are no longer required to reduce the authenticated attack surface

Patch Information

Apache MINA SSHD 2.19.0 fixes the path validation bypass on Windows. For applications tracking the upcoming 3.0.0 major release, upgrade to 3.0.0-M5. Applications not using sshd-git, or not running on Windows, do not require this patch. Consult the Apache Security Mailing List Post for full vendor guidance.

Workarounds

Migrate the affected sshd-git server to a Linux or macOS host until the patched version can be deployed
Restrict SSH access to a minimal set of trusted, authenticated users while patching is in progress
Isolate the Windows host so that no sensitive Git repositories exist outside the configured server root directory

bash

# Update Maven dependency to the patched Apache MINA SSHD release
# pom.xml
<dependency>
  <groupId>org.apache.sshd</groupId>
  <artifactId>sshd-git</artifactId>
  <version>2.19.0</version>
</dependency>