OpenSSH < 10

Tenable 306743 bundles five distinct CVEs fixed in OpenSSH 10.3/10.3p1 released 2026-04-02: CVE-2026-35385 (late validation of shell metacharacters in ssh command-line usernames that could be expanded via %u inside a Match exec block in ssh_config), CVE-2026-35386 (sshd matching authorized_keys principals against certificate principals containing commas incorrectly), CVE-2026-35387 (scp in legacy mode not stripping setuid/setgid bits when root downloads without -p), CVE-2026-35388 (sshd not enforcing PubkeyAcceptedAlgorithms/HostbasedAcceptedAlgorithms correctly for ECDSA — listing one ECDSA algo silently allowed all), and CVE-2026-35414 (ssh ControlMaster ask/autoask confirmation prompt not applied to proxy-mode multiplexing sessions). All versions of OpenSSH < 10.3 (portable < 10.3p1) are flagged.

Tenable's aggregated CVSSv3 of 8.1 is the highest single-CVE score wallpapered across the plugin. In reality none of these five are unauthenticated remote code execution against a default sshd. Three are client-side (ssh/scp); one server-side bug requires an admin to have already deployed cert-based auth with comma-containing principals; the other requires an admin who mis-typed their algorithm allowlist. The HIGH label reflects the scanner's plugin-level ceiling, not the operational risk. Real severity: MEDIUM — hygiene, not an emergency.

Why this verdict

• Not pre-auth RCE: all five bugs require either attacker-controlled input to a local ssh/scp invocation, or a pre-existing CA/key trust relationship. Tenable's 8.1 does not reflect any single realistic chain.
• Prerequisite friction stacks hard: CVE-2026-35385 needs a Match exec block with %u (rare); CVE-2026-35386 needs per-user cert-authority with comma-principals (rarer); CVE-2026-35388 is a policy bypass for someone who already holds a trusted key.
• Role multiplier — jump hosts / bastion servers: even in the high-value bastion role, none of these chains yield fleet compromise. A malicious jump host abusing CVE-2026-35414's ControlMaster prompt bypass extends an already-hostile position rather than creating new access. Floor does not rise above MEDIUM.
• Role multiplier — Git/CI runners invoking ssh with user-derived input: CVE-2026-35385 is genuinely dangerous IF a CI system builds ssh command lines from untrusted metadata AND uses %u in Match exec. This is a narrow but real cluster; on its own it warrants MEDIUM, not HIGH.
• No KEV, no PoC, EPSS <1st percentile. No credible exploitation pressure to override the friction downgrades.

Why not higher?

HIGH would require either an unauthenticated remote path to sshd (there is none in this bundle) or active exploitation (none observed). Tenable's aggregate 8.1 is a scanner artifact — no individual CVE in the set independently justifies HIGH once you account for its prerequisites.

Why not lower?

LOW would ignore the real CI/automation exposure of CVE-2026-35385 and the server-side policy bypasses that could matter to well-instrumented shops running cert-based ssh at scale. MEDIUM correctly reflects 'patch on the normal cycle, no fire drill.'

1. Ban %u inside Match exec blocks in ssh_config fleet-wide — Neutralizes CVE-2026-35385 without patching. Audit /etc/ssh/ssh_config and ~/.ssh/config for Match exec directives that reference %u; replace with static values or a wrapper script that validates the username. Roll out via config management within the noisgate MEDIUM window — no mitigation SLA required, but do it inside 30 days as opportunistic hardening.
2. Force scp to SFTP protocol (-s / ScpProtocol=sftp) — Eliminates CVE-2026-35387 entirely — the setuid-retention bug only exists in the legacy SCP protocol path. Modern OpenSSH already defaults to SFTP; verify no scripts pass -O for legacy compatibility. Deploy alongside the standard patch push.
3. Audit authorized_keys for cert-authority entries with comma-principals — For CVE-2026-35386, grep ~*/.ssh/authorized_keys for cert-authority lines and inspect any principals= restriction containing a comma. Migrate to TrustedUserCAKeys + AuthorizedPrincipalsFile if possible — cleaner, and unaffected by this bug.
4. Prefer Ed25519 over ECDSA and remove ECDSA from PubkeyAcceptedAlgorithms — Sidesteps CVE-2026-35388 by removing ECDSA from the allowlist entirely. If ECDSA is required for legacy clients, be aware the policy is not being enforced curve-by-curve until 10.3 is deployed.
5. Patch to OpenSSH 10.3 / distro-backport equivalent within 365 days — Per noisgate remediation SLA for MEDIUM. Coordinate with your standard sshd change window — no need to jump the queue. Track distro backports (RHEL openssh-*.el9, Ubuntu USN, Amazon Linux ALAS) rather than upstream version strings, since scanners flag on banner.

Run on each Linux/BSD target host as any user (root not required — checks the sshd binary version and the effective installed package). Example: bash check_openssh_103.sh. For fleet use, invoke via your config-management runner (Ansible ad-hoc, SSM, Salt) and collect the exit code: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#!/usr/bin/env bash
# noisgate: verify OpenSSH >= 10.3 (fix for CVE-2026-35385/35386/35387/35388/35414)
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

fail() { echo "VULNERABLE: $*"; exit 1; }
pass() { echo "PATCHED: $*"; exit 0; }
unk()  { echo "UNKNOWN: $*"; exit 2; }

# 1) Prefer sshd -V/-v banner
SSHD_BIN="$(command -v sshd || echo /usr/sbin/sshd)"
[ -x "$SSHD_BIN" ] || unk "sshd binary not found"

RAW="$($SSHD_BIN -V 2>&1 || true)"
[ -z "$RAW" ] && RAW="$($SSHD_BIN -v 2>&1 | head -n1 || true)"
[ -z "$RAW" ] && RAW="$(ssh -V 2>&1 || true)"

# Extract e.g. OpenSSH_10.3p1 or OpenSSH_9.6p1
VER=$(echo "$RAW" | grep -oE 'OpenSSH_[0-9]+\.[0-9]+(p[0-9]+)?' | head -n1)
[ -z "$VER" ] && unk "cannot parse OpenSSH version from: $RAW"

# 2) Compare upstream version
MAJMIN=$(echo "$VER" | sed -E 's/OpenSSH_([0-9]+\.[0-9]+).*/\1/')
MAJ=${MAJMIN%.*}; MIN=${MAJMIN#*.}

UPSTREAM_OK=1
if [ "$MAJ" -gt 10 ]; then UPSTREAM_OK=0
elif [ "$MAJ" -eq 10 ] && [ "$MIN" -ge 3 ]; then UPSTREAM_OK=0
fi

# 3) Distro backport check — trust package metadata over banner if newer patchlevel
if command -v rpm >/dev/null 2>&1; then
  PKG=$(rpm -q --qf '%{NAME}-%{VERSION}-%{RELEASE}\n' openssh-server 2>/dev/null | head -n1)
  case "$PKG" in
    openssh-server-*) echo "note: rpm reports $PKG — consult vendor errata for CVE-2026-35385..35414 backport status" ;;
  esac
elif command -v dpkg-query >/dev/null 2>&1; then
  PKG=$(dpkg-query -W -f='${Package}=${Version}\n' openssh-server 2>/dev/null | head -n1)
  [ -n "$PKG" ] && echo "note: dpkg reports $PKG — consult USN/DSA for backport status"
fi

if [ "$UPSTREAM_OK" -eq 0 ]; then
  pass "$VER >= 10.3 (upstream fix present)"
else
  fail "$VER < 10.3 — verify distro backport via package changelog before concluding exploitable"
fi

Sources

1. Tenable plugin 306743 — OpenSSH < 10.3 Multiple Vulnerabilities
2. OpenSSH 10.3 official release notes
3. OpenSSH release notes index
4. Help Net Security — OpenSSH 10.3 patches five bugs
5. CyberSecurityNews — OpenSSH 10.3 fixes shell injection
6. VulDB CVE-2026-35388 — Proxy-mode multiplexing
7. Broadcom KB — scanners flag OpenSSH CVE-2026-35414 on VCF
8. CISA KEV catalog