PT-2026-107313 · Openbsd · Openssh

CVE-2026-106583

Published

2026-10-06

Updated

2026-10-07

CVSS v3.1

2.5

Low

Vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

In ssh in OpenSSH before 10.6, a $ or character can occur in a command-line username, leading to injection.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-106583

Openssh