CVE-2026-59997: OpenSSH Information Disclosure Flaw

CVE-2026-59997 Overview

CVE-2026-59997 affects the internal-sftp subsystem in sshd in OpenSSH versions before 10.4. The subsystem recognizes only the first 9 command-line arguments passed to it. Administrators who rely on later arguments to enforce security properties of an SFTP connection may see those arguments silently ignored. This behavior can weaken the intended restrictions on chrooted SFTP sessions or other hardened configurations. The issue is classified under [CWE-1284] (improper validation of specified quantity in input).

Critical Impact
Security-relevant internal-sftp arguments beyond position 9 are silently dropped, potentially invalidating the intended isolation or restriction properties of SFTP connections configured in sshd_config.

Affected Products

OpenSSH sshdinternal-sftp subsystem
All OpenSSH releases prior to 10.4
OpenSSH 10.4p1 contains the fix

Discovery Timeline

2026-07-08 - CVE-2026-59997 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59997

Vulnerability Analysis

The internal-sftp server in OpenSSH provides an in-process SFTP implementation invoked from sshd_config via the Subsystem or ForceCommand directives. Administrators pass command-line flags such as -d, -u, -P, or -p to control chroot directories, umask, and permitted or denied SFTP requests.

The argument parser in versions before 10.4 caps input at nine arguments. Any argument beyond the ninth position is not evaluated. When later arguments carry security-relevant flags, such as request whitelists or path restrictions, the connection runs without them.

Exploitation requires a specific misconfiguration where a defender ordered restrictive flags after the ninth argument. Attack complexity is high and user interaction is required, which limits real-world impact. See the OpenSSH Release Notes 10.4p1 and the OpenWall OSS Security Mailing List for the upstream discussion.

Root Cause

The root cause is a hardcoded argument-count limit in the internal-sftp invocation path. The parser silently truncates additional arguments instead of returning an error or logging a warning. This violates the principle that security configuration should fail closed.

Attack Vector

An authenticated SFTP user connects to a server whose administrator relied on the ignored arguments to enforce restrictions. Because the flags were never applied, the user gains the broader access the administrator intended to prevent. The vulnerability is network-reachable but requires the specific vulnerable configuration to be present. See the Marc OpenSSH Development Discussion for the upstream thread.

Detection Methods for CVE-2026-59997

Indicators of Compromise

SFTP sessions performing operations that should have been blocked by -P (deny) or restricted by -p (allow) flags in internal-sftp.
File access outside expected chroot boundaries by users mapped to the internal-sftp subsystem.
Unexpected write, rename, or remove operations logged by sftp-server audit output for restricted users.

Detection Strategies

Audit sshd_config and any Match blocks for Subsystem sftp internal-sftp or ForceCommand internal-sftp invocations with more than nine arguments.
Compare intended restrictions in configuration management against effective runtime behavior by running SFTP smoke tests as restricted accounts.
Enable verbose SFTP logging with -l INFO -f AUTH on the internal-sftp line and review for operations that should have been denied.

Monitoring Recommendations

Log all SFTP file operations centrally and alert on operations by chrooted users that fall outside their designated directories.
Track OpenSSH package versions across the fleet and flag hosts running versions earlier than 10.4.
Monitor sshd_config files for changes that add arguments to internal-sftp invocations.

How to Mitigate CVE-2026-59997

Immediate Actions Required

Upgrade OpenSSH to version 10.4 or later, where the argument parsing limit is removed.
Review every internal-sftp invocation in sshd_config and confirm no security-critical flag appears after the ninth argument.
Reorder arguments so that the most restrictive flags appear first, ensuring they fall within the first nine positions on unpatched hosts.

Patch Information

The fix is included in OpenSSH 10.4p1. Refer to the OpenSSH Release Notes 10.4p1 for the complete changelog. Distributions typically ship the fix in backported packages; verify the vendor advisory for your Linux distribution.

Workarounds

Consolidate internal-sftp arguments so all security-relevant flags appear within the first nine positions.
Replace internal-sftp with the standalone sftp-server binary launched under a wrapper that enforces restrictions independently of argument order.
Enforce filesystem-level restrictions using ChrootDirectory in sshd_config and POSIX permissions rather than relying on internal-sftp command-line flags alone.

bash

# Configuration example: place restrictive flags first, within the first 9 arguments
Match Group sftp-restricted
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp -P remove,rename,symlink -u 0077 -d /upload
    AllowTcpForwarding no
    X11Forwarding no