CVE-2026-35385

EUVD-2026-18398
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
openbsdopenssh
𝑥
< 10.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openssh
bookworm
1:9.2p1-2+deb12u10
fixed
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
1:8.4p1-5+deb11u7
fixed
forky
1:10.3p1-4
fixed
sid
1:10.3p1-5
fixed
trixie
1:10.0p1-7+deb13u4
fixed
trixie (security)
vulnerable
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
openssh
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.4 AUS
0:8.0p1-7.el8_4.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.8 E4S
0:8.0p1-20.el8_8.4
fixed
RHEL 8.8 TUS
0:8.0p1-20.el8_8.4
fixed
RHEL 9
0:9.9p1-7.el9_8
fixed
openssh-askpass
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
RHEL 9
0:9.9p1-7.el9_8
fixed
openssh-cavs
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
openssh-clients
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.4 AUS
0:8.0p1-7.el8_4.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.8 E4S
0:8.0p1-20.el8_8.4
fixed
RHEL 8.8 TUS
0:8.0p1-20.el8_8.4
fixed
RHEL 9
0:9.9p1-7.el9_8
fixed
openssh-keycat
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
RHEL 9
0:9.9p1-7.el9_8
fixed
openssh-ldap
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
openssh-server
RHEL 8
0:8.0p1-29.el8_10
fixed
RHEL 8.4 AUS
0:8.0p1-7.el8_4.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.5
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.5
fixed
RHEL 8.8 E4S
0:8.0p1-20.el8_8.4
fixed
RHEL 8.8 TUS
0:8.0p1-20.el8_8.4
fixed
RHEL 9
0:9.9p1-7.el9_8
fixed
pam
RHEL 8
0:0.10.3-7.29.el8_10
fixed
RHEL 8.6 AUS
0:0.10.3-7.15.el8_6.5
fixed
RHEL 8.6 E4S
0:0.10.3-7.15.el8_6.5
fixed
RHEL 8.6 TUS
0:0.10.3-7.15.el8_6.5
fixed
RHEL 9
0:0.10.4-7.7.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
openssh
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-askpass
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
openssh-cavs
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
openssh-clients
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-clients-debuginfo
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-debuginfo
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-debugsource
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-keycat
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-keycat-debuginfo
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-ldap
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
openssh-server
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-server-debuginfo
Amazon Linux 2023
0:8.7p1-8.amzn2023.0.17
fixed
openssh-server-sysvinit
Amazon Linux 2
0:7.4p1-22.amzn2.0.12
fixed
pam_ssh_agent_auth
Amazon Linux 2
0:0.10.3-2.22.amzn2.0.12
fixed
Amazon Linux 2023
0:0.10.4-4.8.amzn2023.0.17
fixed
pam_ssh_agent_auth-debuginfo
Amazon Linux 2023
0:0.10.4-4.8.amzn2023.0.17
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
openssh
Azure Linux 3.0
0:9.8p1-6.azl3
fixed
Common Weakness Enumeration
References
https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2
https://www.openssh.org/releasenotes.html#10.3p1
https://www.openwall.com/lists/oss-security/2026/04/02/3
https://access.redhat.com/errata/RHSA-2026:12389
https://access.redhat.com/errata/RHSA-2026:13380
https://access.redhat.com/errata/RHSA-2026:13381
https://access.redhat.com/errata/RHSA-2026:13383
https://access.redhat.com/errata/RHSA-2026:14937
https://access.redhat.com/errata/RHSA-2026:16059
https://access.redhat.com/errata/RHSA-2026:19069
https://access.redhat.com/errata/RHSA-2026:19219
https://access.redhat.com/errata/RHSA-2026:20040
https://access.redhat.com/errata/RHSA-2026:21275
https://access.redhat.com/errata/RHSA-2026:21298
https://access.redhat.com/errata/RHSA-2026:21398
https://access.redhat.com/errata/RHSA-2026:22329
https://access.redhat.com/errata/RHSA-2026:22468
https://access.redhat.com/errata/RHSA-2026:22564
https://access.redhat.com/errata/RHSA-2026:22648
https://access.redhat.com/errata/RHSA-2026:25044
https://access.redhat.com/errata/RHSA-2026:25063
https://access.redhat.com/errata/RHSA-2026:25096
https://access.redhat.com/errata/RHSA-2026:25181
https://access.redhat.com/errata/RHSA-2026:26528
https://access.redhat.com/errata/RHSA-2026:26542
https://access.redhat.com/errata/RHSA-2026:28887
https://access.redhat.com/errata/RHSA-2026:30078
https://access.redhat.com/errata/RHSA-2026:30087
https://access.redhat.com/errata/RHSA-2026:30088
https://access.redhat.com/errata/RHSA-2026:30089
https://access.redhat.com/security/cve/CVE-2026-35385
https://bugzilla.redhat.com/show_bug.cgi?id=2454469
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json