CVE-2026-58624

Received Received - Intake

Remote Code Execution via GitPgmCommandFactory in Apache MINA SSHD

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Apache Software Foundation

Description

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue. The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-58624

Affected Vendors & Products

Vendor	Product	Version / Range
apache	mina	From 2.19.0 (inc) to 3.0.0-M5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper input validation issue in sshd-git within Apache MINA SSHD, a Java library for SSH functionality. It allows authenticated SSH users to execute arbitrary JGit commands on the server, including commands that can write files to any location, such as using git archive with the --output option.

Detection Guidance

Check if your Apache MINA SSHD server uses the GitPgmCommandFactory. Inspect server configuration files for the presence of GitPgmCommandFactory settings. Verify the version of Apache MINA SSHD in use. If using vulnerable versions (below 2.19.0 or 3.0.0-M5), the server is likely affected.

Impact Analysis

An attacker with SSH access could exploit this to write malicious files anywhere on the server, potentially leading to remote code execution, data corruption, or unauthorized access. Servers not using GitPgmCommandFactory are unaffected.

Compliance Impact

This vulnerability could lead to unauthorized file writes, violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized access or data breaches may result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Apache MINA SSHD to version 2.19.0 or 3.0.0-M5 or later. If GitPgmCommandFactory is not required, disable or remove its configuration from the server. Ensure only trusted users have SSH access to the server.

Hi! I’m here to help you understand CVE-2026-58624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70