CVE-2026-35414

ADVISORY - nist

Summary

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

EPSS Score⁠: 0.00176 (0.074)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-670⁠

Always-Incorrect Control Flow Implementation

ADVISORY - redhat

CWE-168⁠

Improper Handling of Inconsistent Special Elements

Impacted images

Advisories

Alpine

CREATED

4 months ago

UPDATED

21 days ago

ADVISORY IDCVE-2026-35414⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Package	Type	OS Name	OS Version	Affected Ranges	Fix Versions
alpine/openssh	apk	alpine	3.23	<=10.2_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.21	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.21	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.9_p1-r2	Not yet available
alpine/openssh	apk	alpine	3.21	<=9.9_p2-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.19	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.19	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.6_p1-r1	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.6_p1-r2	Not yet available
alpine/openssh	apk	alpine	3.19	<=9.7_p2-r5	Not yet available
alpine/openssh	apk	alpine	edge	<10.3_p1-r0	10.3_p1-r0
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r10	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r7	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.22	<=10.0_p1-r9	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.22	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.22	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=9.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.22	<=9.9_p2-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.5_p1-r8	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.20	<=7.9_p1-r3	Not yet available
alpine/openssh	apk	alpine	3.20	<=8.4_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=8.5_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=8.8_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=9.6_p1-r0	Not yet available
alpine/openssh	apk	alpine	3.20	<=9.7_p1-r4	Not yet available
alpine/openssh	apk	alpine	3.20	<=9.7_p1-r5	Not yet available
alpine/openssh	apk	alpine	3.24	<10.3_p1-r0	10.3_p1-r0

Severity and metrics

No CVSS data available from this advisory.

NIST

CREATED

5 months ago

UPDATED

4 months ago

ADVISORY IDCVE-2026-35414⁠

EXPLOITABILITY SCORE

1.6

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-670⁠

CVSS SCORE

4.2medium

Debian

CREATED

5 months ago

UPDATED

3 months ago

ADVISORY IDCVE-2026-35414⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

5 months ago

UPDATED

25 days ago

ADVISORY IDCVE-2026-35414⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

8.1medium

Alma

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALSA-2026:13381⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Alma

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALSA-2026:13383⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Alma

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALSA-2026:19219⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Amazon

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALAS2-2026-3320⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Amazon

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDALAS2023-2026-1745⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Red Hat

CREATED

5 months ago

UPDATED

4 months ago

ADVISORY IDCVE-2026-35414⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-168⁠

CVSS SCORE

4.8medium

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:13380⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:13381⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:13383⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:19069⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Rocky

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDRLSA-2026:19219⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDELSA-2026-13380⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDELSA-2026-13381⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

3 months ago

UPDATED

3 months ago

ADVISORY IDELSA-2026-13383⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY IDELSA-2026-19069⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Oracle

CREATED

2 months ago

UPDATED

2 months ago

ADVISORY IDELSA-2026-19219⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Ahigh

Photon

CREATED

4 months ago

UPDATED

3 months ago

ADVISORY ID

CVE-2026-35414

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

8.1high