CVE-2026-35414
Openbsd Openssh ≤ 10.3
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-35414 is a medium-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Openbsd Openssh. Its CVSS base score is 4.2 (Medium).
Operationally, ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-35414 affects OpenSSH versions before 10.3, where the software mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. This vulnerability is classified under CWE-670 and carries a CVSS v3.1 base score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-severity issue with network accessibility but high attack complexity.
Exploitation requires low privileges (PR:L) and can be performed over the network (AV:N) without user interaction (UI:N), though the high attack complexity (AC:H) limits practicality. Successful attacks result in low impacts to confidentiality and integrity (C:L/I:L), with no availability disruption (A:N) and unchanged scope (S:U).
Mitigation is addressed in OpenSSH 10.3, as detailed in the project's release notes at https://www.openssh.org/releasenotes.html#10.3p1. Further technical discussion appears in developer mailing lists, including https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2 and https://www.openwall.com/lists/oss-security/2026/04/02/3, recommending upgrades to patched versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18480
Vulnerability Data
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V9.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises control-flow paths and reveals mismatches between implemented and intended behavior.
Requiring a documented development process and supporting tools reduces the chance that incorrect control-flow logic is introduced in the first place.
Flaw identification and remediation processes can locate and correct control-flow errors once they manifest as incorrect runtime behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent incorrect control-flow implementations via reviews, testing, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect paths that deviate from intended logic.
Secure development lifecycle processes can catch incorrect control-flow logic during design and code review.
Secure coding standards and reviews directly target flawed control-flow implementations.
Change-management gates may prevent deployment of flawed logic but do not address the coding defect itself.