Loading vulnerability…
Shell Metacharacter Injection in libssh ProxyCommand Username Expansion
CVE-2026-59846 is a shell metacharacter injection vulnerability in libssh ProxyCommand handling. When expanding the %r placeholder, libssh does not adequately sanitize the substituted username before it is interpreted by a shell. An attacker-controlled username containing shell metacharacters can alter ProxyCommand interpretation, potentially exposing environment variables and causing unintended shell behavior.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information, including environment variables accessible to the process executing ProxyCommand, and alter shell command behavior. The vulnerability-specific CVSS v3.0 assessment is 3.9, with low confidentiality and integrity impacts and no assessed availability impact. Privilege escalation and unrestricted arbitrary code execution are not established.
If you can’t patch tonight, do this now.
Until patched, disable affected ProxyCommand usage or avoid configurations that expand untrusted usernames through %r. Restrict usernames and ProxyCommand inputs to trusted, validated values, rejecting shell metacharacters before expansion.
Patch, then assume compromise.
Install the distribution-specific libssh security update and update associated packages as applicable. Fixed package releases include Ubuntu 22.04 LTS libssh-4 0.9.6-2ubuntu0.22.04.8, Ubuntu 24.04 LTS 0.10.6-2ubuntu0.5, Ubuntu 26.04 LTS 0.11.3-1ubuntu2.1, Debian 13 0.11.5-0+deb13u1, RHEL 8 0.9.6-17.el8_10, RHEL 9 0.10.4-19.el9_8, and RHEL 10 0.12.0-3.el10_2. Use the applicable vendor advisory rather than treating these distribution-specific versions as universal upstream fixed-version boundaries.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.