CVE-2026-106589 Privilege escalation in OpenSSH
Attackers can gain root privileges in specific environments like QNX or SCO OpenServer due to sshd-session mishandling privileges when GatewayPorts or StreamLocalForwarding are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-106589?
CVE-2026-106589 is a low-severity vulnerability in OpenBSD OpenSSH, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.
Weakness: CWE-272
Which versions are affected by CVE-2026-106589?
How do I fix CVE-2026-106589?
No fix has been published for CVE-2026-106589 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-106589 being exploited?
There is no known exploitation of CVE-2026-106589 in the wild and no public exploit code.
Sources
Also known as AZL-106697, DEBIAN-CVE-2026-106589, GHSA-8wpc-x9xg-9q94, UBUNTU-CVE-2026-106589.