CVE-2026-35414
Published: 02 April 2026
Summary
CVE-2026-35414 is a medium-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Openbsd Openssh. Its CVSS base score is 4.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-35414 affects OpenSSH versions before 10.3, where the software mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. This vulnerability is classified under CWE-670 and carries a CVSS v3.1 base score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-severity issue with network accessibility but high attack complexity.
Exploitation requires low privileges (PR:L) and can be performed over the network (AV:N) without user interaction (UI:N), though the high attack complexity (AC:H) limits practicality. Successful attacks result in low impacts to confidentiality and integrity (C:L/I:L), with no availability disruption (A:N) and unchanged scope (S:U).
Mitigation is addressed in OpenSSH 10.3, as detailed in the project's release notes at https://www.openssh.org/releasenotes.html#10.3p1. Further technical discussion appears in developer mailing lists, including https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2 and https://www.openwall.com/lists/oss-security/2026/04/02/3, recommending upgrades to patched versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18480
Vulnerability details
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is in OpenSSH (a commonly exposed remote access service) and is exploitable over the network (AV:N), enabling initial access via exploitation of a public-facing application despite high complexity and low impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like the OpenSSH principals parsing vulnerability via patching to version 10.3 or later.
Enables vulnerability scanning to identify systems running vulnerable OpenSSH versions affected by CVE-2026-35414.
Mandates secure configuration settings for OpenSSH to minimize exposure to uncommon authorized_keys principals scenarios involving commas.