CVE Feed

    Dashboard / CVE / CVE-2026-35385

    CVE-2026-35385

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

    Published:Apr 2, 2026
    Last Modified:Aug 25, 2026
    EPS:Apr 2, 2026
    EPSS Score:0.00612
    CVSS Score:7.5

    Affected Products

    Vendor
    Openbsd
    Product
    Openssh

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-73283 (CVSS 2.5) — In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tun…
    CVE-2026-73282 (CVSS 4.8) — In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forward…
    CVE-2026-73281 (CVSS 3.5) — In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locall…
    CVE-2026-60002 (CVSS 7.7) — ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchan…
    CVE-2026-60001 (CVSS 6.5) — sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.…
    CVE-2026-60000 (CVSS 3.7) — sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from ex…
    CVE-2026-59999 (CVSS 5.9) — In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, b…
    CVE-2026-59998 (CVSS 4.8) — sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no v…
    CVE-2026-59997 (CVSS 4.2) — internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be …
    CVE-2026-59996 (CVSS 4.2) — scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occ…

    References

    https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2
    https://www.openssh.org/releasenotes.html#10.3p1
    https://www.openwall.com/lists/oss-security/2026/04/02/3
    https://access.redhat.com/errata/RHSA-2026:12389
    https://access.redhat.com/errata/RHSA-2026:13380
    https://access.redhat.com/errata/RHSA-2026:13381
    https://access.redhat.com/errata/RHSA-2026:13383
    https://access.redhat.com/errata/RHSA-2026:14937
    https://access.redhat.com/errata/RHSA-2026:16059
    https://access.redhat.com/errata/RHSA-2026:19069
    https://access.redhat.com/errata/RHSA-2026:19219
    https://access.redhat.com/errata/RHSA-2026:20040
    https://access.redhat.com/errata/RHSA-2026:21275
    https://access.redhat.com/errata/RHSA-2026:21298
    https://access.redhat.com/errata/RHSA-2026:21398
    https://access.redhat.com/errata/RHSA-2026:22329
    https://access.redhat.com/errata/RHSA-2026:22468
    https://access.redhat.com/errata/RHSA-2026:22564
    https://access.redhat.com/errata/RHSA-2026:22648
    https://access.redhat.com/errata/RHSA-2026:25044
    https://access.redhat.com/errata/RHSA-2026:25063
    https://access.redhat.com/errata/RHSA-2026:25096
    https://access.redhat.com/errata/RHSA-2026:25181
    https://access.redhat.com/errata/RHSA-2026:26528
    https://access.redhat.com/errata/RHSA-2026:26542
    https://access.redhat.com/errata/RHSA-2026:28887
    https://access.redhat.com/errata/RHSA-2026:28962
    https://access.redhat.com/errata/RHSA-2026:30078
    https://access.redhat.com/errata/RHSA-2026:30087
    https://access.redhat.com/errata/RHSA-2026:30088
    https://access.redhat.com/errata/RHSA-2026:30089
    https://access.redhat.com/errata/RHSA-2026:34098
    https://access.redhat.com/errata/RHSA-2026:58981
    https://access.redhat.com/security/cve/CVE-2026-35385
    https://bugzilla.redhat.com/show_bug.cgi?id=2454469
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High