CVE-2026-106589

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in OpenSSH via Misconfigured GatewayPorts

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: MITRE

Description

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-106589

EUVD

EUVD-2026-94055

Affected Vendors & Products

Vendor	Product	Version / Range
OpenBSD	OpenSSH	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-272	The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenSSH through version 10.6 in specific environments like QNX 6 and SCO OpenServer 5. Due to misconfigurations in GatewayPorts and StreamLocalForwarding, sshd sessions may unexpectedly gain root privileges. This occurs because the system lacks support for file-descriptor passing and unprivileged allocation of PTY devices.

Detection Guidance

This vulnerability is specific to certain environments like QNX 6 and SCO OpenServer 5 where OpenSSH through 10.6 may grant root privileges unexpectedly due to GatewayPorts and StreamLocalForwarding settings. Check OpenSSH configuration files for these options and verify privilege separation behavior. No direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to escalate privileges on affected systems, potentially gaining root access. This could lead to unauthorized control over the system, data theft, or further network compromise if the vulnerable OpenSSH instance is exposed.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR (data confidentiality) or HIPAA (system integrity). Unauthorized root access risks exposing sensitive data, leading to potential legal and regulatory penalties.

Mitigation Strategies

Update OpenSSH to version 10.6 or later to address the privilege escalation issue. Disable GatewayPorts and StreamLocalForwarding if not required. Ensure file-descriptor passing and PTY allocation are properly configured for unprivileged access.

Hi! I’m here to help you understand CVE-2026-106589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70