Executive brief
OpenSSH is a widely used suite of secure networking utilities for remote login and file transfer. A security flaw was identified where the system failed to ask for user confirmation when a new connection attempted to join an existing shared session in 'proxy mode.' This could allow an unauthorized local process to hijack a user's active connection without their knowledge, though it requires specific configurations to be active.
Technical details
A vulnerability exists in OpenSSH's connection multiplexing feature (ControlMaster). When 'ControlMaster ask' or 'autoask' is configured, the client is intended to prompt the user for confirmation before allowing a new session to join the existing multiplexed connection. However, in versions prior to 10.3, this confirmation check was omitted for proxy-mode multiplexing sessions (invoked via 'ssh -O proxy'). A local attacker or malicious process on the same client machine could exploit this to join an existing SSH multiplexing socket without the legitimate user being prompted to allow the connection. This issue is tracked as CWE-420 (Unprotected Alternate Channel). The fix was introduced in OpenSSH 10.3.
Affected products
- OpenBSD OpenSSH before 10.3
Timeline
- 2026-04-02: disclosed: Vulnerability disclosed in OpenSSH 10.3 release notes.
- 2026-04-02: patched: OpenSSH 10.3 released fixing the issue.