CVE-2026-59846: libssh ProxyCommand RCE Vulnerability

CVE-2026-59846 Overview

CVE-2026-59846 is a command injection vulnerability in libssh, the widely used C library implementing the SSH protocol. The flaw resides in ProxyCommand handling, where the %r token expands to the remote username without sanitization. A malicious username containing shell metacharacters is passed to the shell, exposing environment variables and triggering unintended shell behavior. The weakness is classified as [CWE-77] Improper Neutralization of Special Elements Used in a Command.

Critical Impact
A crafted username expanded through %r in ProxyCommand allows local injection of shell metacharacters, leading to limited confidentiality and integrity impact when a user connects to an attacker-influenced host configuration.

Affected Products

libssh (as distributed by Red Hat, per RHSA-2026:42922)
Red Hat Enterprise Linux packages linking libssh with ProxyCommand support
Downstream applications invoking libssh client APIs that honor ProxyCommand tokens

Discovery Timeline

2026-07-21 - CVE-2026-59846 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59846

Vulnerability Analysis

The vulnerability affects how libssh expands SSH configuration tokens before invoking a ProxyCommand. When a client parses a configuration containing ProxyCommand with the %r placeholder, libssh substitutes the remote username into the command string. The library then passes the resulting string to a shell interpreter without escaping shell metacharacters.

An attacker who controls or influences the username value can embed characters such as `, $(), ;, &, or | into the expansion. These characters break out of the intended argument and execute as shell syntax. Exploitation requires local access, low privileges, and user interaction, as reflected in the attack vector. The impact is limited to confidentiality and integrity of the invoking user's session, not full system compromise.

Root Cause

The root cause is improper neutralization of special elements in a command string ([CWE-77]). The %r token expansion concatenates untrusted input directly into a shell command line. No quoting, escaping, or argument-array execution model isolates the username from shell parsing.

Attack Vector

Exploitation requires a victim to initiate an SSH connection using an attacker-supplied or attacker-influenced configuration that specifies both a malicious username and a ProxyCommand referencing %r. Delivery paths include shared ssh_config files, URI handlers, project checkout scripts, or command-line arguments passed by another application. On execution, the injected metacharacters run in the context of the local user, disclosing environment variables and altering shell behavior. See the Red Hat CVE-2026-59846 Details for vendor analysis.

Detection Methods for CVE-2026-59846

Indicators of Compromise

SSH client configuration files containing ProxyCommand directives with %r tokens combined with unusual usernames.
Process telemetry showing ssh or libssh-linked binaries spawning shell child processes with metacharacters such as `, $(), ;, or | in the command line.
Unexpected environment variable references such as $HOME, $PATH, or $SSH_AUTH_SOCK appearing in ProxyCommand invocations.

Detection Strategies

Audit all ssh_config, ~/.ssh/config, and application-generated SSH configurations for ProxyCommand lines referencing %r.
Correlate parent-child process events where an SSH client process launches /bin/sh -c with argument strings containing shell control operators.
Track invocations of libssh-linked applications on multi-user systems to identify anomalous username values passed at connection time.

Monitoring Recommendations

Enable command-line logging on Linux endpoints via auditd or equivalent to capture full argument vectors for SSH client processes.
Alert on writes to shared ssh_config locations under /etc/ssh/ or user profile directories in automation contexts.
Baseline expected ProxyCommand templates in your environment and flag deviations for review.

How to Mitigate CVE-2026-59846

Immediate Actions Required

Apply the libssh update distributed through Red Hat Security Erratum RHSA-2026:42922 and equivalent updates from other distributions.
Review and sanitize any ProxyCommand configurations that use %r expansion, especially where usernames originate from external input.
Restrict write access to shared SSH configuration files to trusted administrators only.

Patch Information

Red Hat has published a fixed libssh package under RHSA-2026:42922. Details of the vendor's analysis are available in Red Hat Bug #2498179 and the Red Hat CVE-2026-59846 Details page. Administrators should update libssh and restart any long-running services that link the library.

Workarounds

Avoid using the %r token in ProxyCommand directives until patches are applied across all hosts.
Enforce strict validation of usernames supplied to SSH client wrappers, rejecting values containing shell metacharacters.
Where feasible, replace ProxyCommand with the ProxyJump directive, which does not invoke a shell for token expansion.

bash

# Configuration example: audit and disable %r expansion until patched
grep -RIn --include='config' -E 'ProxyCommand.*%r' /etc/ssh/ ~/.ssh/ 2>/dev/null

# Safer alternative using ProxyJump instead of ProxyCommand
# ~/.ssh/config
Host internal-*
    ProxyJump bastion.example.com
    User deploy