USN-8222-1

Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol (-O) option. This could result in certain files being installed setuid or setgid, contrary to expectations. (CVE-2026-35385)

Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell metacharacters in usernames within a command line. When untrusted usernames and non-default configurations using % in ssh_config are being used, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-35386)

Christos Papakonstantinou discovered that OpenSSH incorrectly handled parsing the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms options. This could result in unintended ECDSA algorithms being used, contrary to expectations. (CVE-2026-35387)

Michalis Vasileiadis discovered that OpenSSH incorrectly handled proxy-mode multiplexing sessions. This could result in no confirmation being asked, contrary to expectations. (CVE-2026-35388)

Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates with the principal name containing a comma character when using user-trusted CA keys in authorizedkeys and an authorizedkeys principals="" option that lists more than one principal. This could result in inappropriate principal matching, contrary to expectations. (CVE-2026-35414)

References

Affected packages

Ubuntu:22.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:8.9p1-3ubuntu0.15?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:8.9p1-3ubuntu0.15

Affected versions

1:8.*

1:8.4p1-6ubuntu2

1:8.7p1-2

1:8.7p1-2build1

1:8.7p1-4

1:8.8p1-1

1:8.9p1-3

1:8.9p1-3ubuntu0.1

1:8.9p1-3ubuntu0.3

1:8.9p1-3ubuntu0.4

1:8.9p1-3ubuntu0.5

1:8.9p1-3ubuntu0.6

1:8.9p1-3ubuntu0.7

1:8.9p1-3ubuntu0.10

1:8.9p1-3ubuntu0.11

1:8.9p1-3ubuntu0.13

1:8.9p1-3ubuntu0.14

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "openssh-client",
            "binary_version": "1:8.9p1-3ubuntu0.15"
        },
        {
            "binary_name": "openssh-server",
            "binary_version": "1:8.9p1-3ubuntu0.15"
        },
        {
            "binary_name": "openssh-sftp-server",
            "binary_version": "1:8.9p1-3ubuntu0.15"
        },
        {
            "binary_name": "openssh-tests",
            "binary_version": "1:8.9p1-3ubuntu0.15"
        },
        {
            "binary_name": "ssh",
            "binary_version": "1:8.9p1-3ubuntu0.15"
        },
        {
            "binary_name": "ssh-askpass-gnome",
            "binary_version": "1:8.9p1-3ubuntu0.15"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-35385",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35386",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35387",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35388",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35414",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8222-1.json"

Ubuntu:24.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:9.6p1-3ubuntu13.16?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.6p1-3ubuntu13.16

Affected versions

1:9.*

1:9.3p1-1ubuntu3

1:9.4p1-1ubuntu1

1:9.6p1-3ubuntu1

1:9.6p1-3ubuntu2

1:9.6p1-3ubuntu11

1:9.6p1-3ubuntu12

1:9.6p1-3ubuntu13

1:9.6p1-3ubuntu13.3

1:9.6p1-3ubuntu13.4

1:9.6p1-3ubuntu13.5

1:9.6p1-3ubuntu13.7

1:9.6p1-3ubuntu13.8

1:9.6p1-3ubuntu13.9

1:9.6p1-3ubuntu13.11

1:9.6p1-3ubuntu13.12

1:9.6p1-3ubuntu13.13

1:9.6p1-3ubuntu13.14

1:9.6p1-3ubuntu13.15

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "openssh-client",
            "binary_version": "1:9.6p1-3ubuntu13.16"
        },
        {
            "binary_name": "openssh-server",
            "binary_version": "1:9.6p1-3ubuntu13.16"
        },
        {
            "binary_name": "openssh-sftp-server",
            "binary_version": "1:9.6p1-3ubuntu13.16"
        },
        {
            "binary_name": "openssh-tests",
            "binary_version": "1:9.6p1-3ubuntu13.16"
        },
        {
            "binary_name": "ssh",
            "binary_version": "1:9.6p1-3ubuntu13.16"
        },
        {
            "binary_name": "ssh-askpass-gnome",
            "binary_version": "1:9.6p1-3ubuntu13.16"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-35385",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35386",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35387",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35388",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35414",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8222-1.json"

Ubuntu:25.10 / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:10.0p1-5ubuntu5.4?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:10.0p1-5ubuntu5.4

Affected versions

1:9.*

1:9.9p1-3ubuntu3

1:9.9p1-3ubuntu3.1

1:10.*

1:10.0p1-5ubuntu2

1:10.0p1-5ubuntu3

1:10.0p1-5ubuntu4

1:10.0p1-5ubuntu5

1:10.0p1-5ubuntu5.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "openssh-client",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "openssh-client-gssapi",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "openssh-server",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "openssh-server-gssapi",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "openssh-sftp-server",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "openssh-tests",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "ssh",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        },
        {
            "binary_name": "ssh-askpass-gnome",
            "binary_version": "1:10.0p1-5ubuntu5.4"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-35385",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35386",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35387",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35388",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35414",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:25.10"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8222-1.json"

Ubuntu:26.04 / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:10.2p1-2ubuntu3.2?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:10.2p1-2ubuntu3.2

Affected versions

1:10.*

1:10.0p1-5ubuntu5

1:10.2p1-2ubuntu1

1:10.2p1-2ubuntu3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "openssh-client",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "openssh-client-gssapi",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "openssh-server",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "openssh-server-gssapi",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "openssh-sftp-server",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "openssh-tests",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "ssh",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        },
        {
            "binary_name": "ssh-askpass-gnome",
            "binary_version": "1:10.2p1-2ubuntu3.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-35385",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35386",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35387",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35388",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-35414",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:26.04"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8222-1.json"