CVE-2026-106588

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: MITRE

Description

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106588

EUVD

EUVD-2026-94050

Affected Vendors & Products

Vendor	Product	Version / Range
OpenBSD	OpenSSH	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-653	The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenSSH through version 10.6 occurs when using the macOS 27 SDK or later. It results in the loss of sandboxing functionality, which is an unexpected side effect. Sandboxing is a security mechanism that isolates processes to limit potential damage from vulnerabilities.

Detection Guidance

This vulnerability is related to sandboxing loss in OpenSSH when using macOS SDK 27 or later. Detection requires checking OpenSSH version and macOS SDK compatibility. No specific commands are provided in the context to detect this issue directly.

Impact Analysis

The loss of sandboxing could allow an attacker with local access to escape restrictions and perform unauthorized actions. This might lead to privilege escalation or further exploitation of the system, though the CVSS score suggests limited impact (BaseScore 3.1).

Compliance Impact

The vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves sandboxing loss in OpenSSH on macOS 27+, which could indirectly affect security controls but lacks specific details on regulatory implications.

Mitigation Strategies

Update OpenSSH to a version beyond 10.6 to avoid the macOS SDK side effect causing loss of sandboxing. Verify sandboxing functionality after update.

Hi! I’m here to help you understand CVE-2026-106588. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70