Executive brief
OpenSSH is a widely used tool for secure remote access to servers. A vulnerability in how it handles security certificates could allow an unauthorized person to log in to a server if the server's configuration uses a specific "principals" list and trusts a Certificate Authority that allows commas in names. This could lead to a complete takeover of the affected user account and access to sensitive data.
Technical details
A logic error exists in sshd(8) when matching the 'principals' option in an authorized_keys file against a list of principals encoded in an SSH certificate. The matching algorithm incorrectly handles cases where a principal name in the certificate contains a comma character. An attacker can exploit this if the target's authorized_keys file lists multiple principals and trusts a Certificate Authority (CA) that allows commas within the principal names it issues. This vulnerability specifically affects user-trusted CA keys in authorized_keys; the standard TrustedUserCAKeys and AuthorizedPrincipalsFile paths are not impacted. Successful exploitation allows an attacker to bypass intended principal restrictions and authenticate as a different user. The issue is resolved in OpenSSH 10.3.
Affected products
- OpenBSD OpenSSH before 10.3
Timeline
- 2026-04-02: disclosed: Vulnerability disclosed in OpenSSH 10.3 release notes.
- 2026-04-02: patched: OpenSSH 10.3 released.