All vulnerabilities

Servers and applications

CVE-2026-106589

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.

Severity
Low 2.9
Published
6 Oct 2026
Last changed
7 Oct 2026
Added to UpHeron
3 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
OpenSSHServers and applications · cna:openbsd|openssh
  • Every version up to 10.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-106589