CVE-2026-106583: OpenSSH: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, le…
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
- CVE-2026-106583CVE identifier
- 7.8CVSS 3.1 base score (high)
- 0.2%EPSS: chance of exploitation in the next 30 days (higher than 4% of CVEs)
- 2026-10-06published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run OpenSSH and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- sudo systemctl restart ssh (Debian/Ubuntu) or sshd (RHEL/SUSE/Fedora/Arch/Amazon); Alpine: rc-service sshd restart; FreeBSD: service sshd restart
Affected and fixed versions
Affected:
- OpenBSD OpenSSH before 10.6
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade openssh-server openssh-clientUbuntu
sudo apt update
sudo apt install --only-upgrade openssh-server openssh-clientRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh openssh-server opensshFedora
sudo dnf upgrade --refresh openssh-server opensshSUSE / openSUSE
sudo zypper refresh
sudo zypper update openssh openssh-serverAmazon Linux
sudo dnf upgrade --releasever=latest openssh-server opensshArch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade openssh openssh-serverFreeBSD
pkg update && pkg upgrade openssh-portable (port; the base-system sshd is patched with freebsd-update)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | openssh | not fixed yet | |
| Debian 13 | openssh | not fixed yet | |
| Debian testing | openssh | fixed | 1:10.6p1-1 |
| Debian testing | openssh-gssapi | fixed | 1:10.6p1-1 |
| Ubuntu 26.10 | openssh | fixed | 1:10.5p1-1ubuntu3.1 |
| Ubuntu 18.04 (ESM) | openssh | being checked | |
| Ubuntu 20.04 (ESM) | openssh | being checked | |
| Ubuntu 22.04 | openssh | fixed | 1:8.9p1-3ubuntu0.18 |
| Ubuntu 24.04 | openssh | fixed | 1:9.6p1-3ubuntu13.20 |
| Ubuntu 26.04 | openssh | fixed | 1:10.2p1-2ubuntu3.8 |
| Ubuntu 18.04 (ESM) | openssh-ssh1 | not planned | |
| Ubuntu 20.04 (ESM) | openssh-ssh1 | not planned | |
| Ubuntu 22.04 | openssh-ssh1 | not planned | |
| Ubuntu 24.04 | openssh-ssh1 | not planned | |
| Ubuntu 26.04 | openssh-ssh1 | not planned | |
| Ubuntu 26.10 | openssh-ssh1 | not planned | |
| Ubuntu 26.10 | openssh-gssapi | fixed | 1:10.5p1-1ubuntu3.1 |
| Red Hat Enterprise Linux 9 | openssh | affected | |
| Red Hat Enterprise Linux 8 | openssh | affected | |
| Red Hat Enterprise Linux 7 | openssh | affected | |
| Red Hat Enterprise Linux 6 | openssh | affected | |
| Red Hat Enterprise Linux 10 | openssh | affected | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.