CVE-2026-60002: OpenSSH Use-After-Free Vulnerability

CVE-2026-60002 Overview

CVE-2026-60002 is a use-after-free vulnerability [CWE-416] in the OpenSSH client. The flaw affects ssh versions prior to 10.4 and triggers when a server changes its host key during a key re-exchange. The condition occurs only on the client side, meaning a malicious or compromised SSH server can influence memory state within a connecting client.

Critical Impact
A malicious SSH server can induce use-after-free conditions in connecting clients by altering its host key during key re-exchange, potentially leading to memory corruption on the client host.

Affected Products

OpenSSH ssh client versions before 10.4
OpenSSH portable releases before 10.4p1
Downstream Linux and Unix distributions bundling vulnerable OpenSSH client builds

Discovery Timeline

2026-07-08 - CVE-2026-60002 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-60002

Vulnerability Analysis

The vulnerability resides in the OpenSSH client's handling of SSH key re-exchange (KEX). SSH connections periodically renegotiate cryptographic material to preserve forward secrecy. During this renegotiation, the client validates the server's host key. If the server presents a different host key than the one used during the initial handshake, the client transitions into an error handling path that references memory already released.

The use-after-free condition [CWE-416] arises because the client retains pointers to host key structures that are deallocated when the key mismatch is detected. Subsequent access to these dangling pointers can corrupt heap metadata, leak sensitive memory contents, or influence control flow. Exploitation requires a hostile or compromised server, which is why the flaw scores lower on integrity and availability compared to typical remote memory corruption bugs.

Root Cause

The root cause is improper lifetime management of host key objects across the SSH re-keying state machine. The client releases the prior host key structure without invalidating references held by other components of the session state. When the re-exchange logic revisits those references to compare or log the key change, it operates on freed memory.

Attack Vector

An attacker must operate an SSH server that a victim client connects to, or intercept traffic and impersonate a legitimate server. Once the client initiates a key re-exchange, the malicious server presents a modified host key. This action triggers the vulnerable code path in the client. The attack complexity is high because the attacker must control the server side and induce a re-exchange event during an active session.

No verified public exploit code is available. Technical details are discussed in the OpenSSH Development Discussion and the OpenWall OSS-Security Mailing List Post.

Detection Methods for CVE-2026-60002

Indicators of Compromise

SSH client crashes or abnormal terminations correlated with re-keying events
Client-side log entries reporting host key changes mid-session rather than at initial connection
Outbound SSH sessions to servers that repeatedly initiate rapid re-exchanges

Detection Strategies

Inventory endpoints for OpenSSH client versions below 10.4 using package managers or configuration management tooling
Monitor SSH client process telemetry for segmentation faults or heap corruption signatures
Inspect SSH debug logs (ssh -vvv) in sensitive environments for unexpected host key changed messages during established sessions

Monitoring Recommendations

Alert on core dumps generated by ssh binaries on managed endpoints
Correlate outbound SSH connections with destinations outside approved server inventories
Track EDR telemetry for anomalous child process behavior spawned by the SSH client

How to Mitigate CVE-2026-60002

Immediate Actions Required

Upgrade OpenSSH client packages to version 10.4 or 10.4p1 on all affected hosts
Restrict outbound SSH connections from privileged workstations to a vetted server allowlist
Verify server host key pinning configurations to detect unexpected key changes

Patch Information

OpenSSH resolved the issue in release 10.4p1. Refer to the OpenSSH Release Notes 10.4p1 for the full changelog. Linux distributions have shipped backported fixes through their standard security update channels; apply distribution updates promptly.

Workarounds

Disable client-initiated re-keying by setting RekeyLimit to a value unlikely to be reached within session lifetimes, though this does not prevent server-initiated re-exchange
Enforce strict host key checking with StrictHostKeyChecking yes and maintain a curated known_hosts file
Avoid connecting SSH clients to untrusted or unmanaged servers until patching is complete

bash

# Verify installed OpenSSH client version
ssh -V

# Debian/Ubuntu: apply security updates
sudo apt-get update && sudo apt-get install --only-upgrade openssh-client

# RHEL/Fedora: apply security updates
sudo dnf upgrade openssh-clients

# Enforce strict host key checking in ~/.ssh/config
Host *
    StrictHostKeyChecking yes
    UpdateHostKeys no