Is CVE-2026-35414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35414 being exploited in the wild.

How severe is CVE-2026-35414?

Medium severity, with a CVSS score of 4.2, published 2 April 2026.

Is there a fix for CVE-2026-35414?

A patch was published on 2026-04-02: OpenSSH 10.3 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35414 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35414?

Check whether you run OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35414: OpenBSD OpenSSH incorrect principal matching in sshd via authorized_keys

CVE-2026-35414 · Severity: medium · CVSS 4.2 · Published 2026-04-02

OpenSSH is a widely used tool for secure remote access to servers. A vulnerability in how it handles security certificates could allow an unauthorized person to log in to a server if the server's configuration uses a specific "principals" list and trusts a Certificate Authority that allows commas in names. This could lead to a complete takeover of the affected user account and access to sensitive data.

Technologies: OpenBSD Openssh. Vendors: OpenBSD.

Quick answers

Is CVE-2026-35414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35414 being exploited in the wild.
How severe is CVE-2026-35414?: Medium severity, with a CVSS score of 4.2, published 2 April 2026.
Which products and versions are affected?: OpenBSD Openssh before 10.3.
Is there a fix for CVE-2026-35414?: A patch was published on 2026-04-02: OpenSSH 10.3 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35414 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35414?: Check whether you run OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error exists in sshd(8) when matching the 'principals' option in an authorized_keys file against a list of principals encoded in an SSH certificate. The matching algorithm incorrectly handles cases where a principal name in the certificate contains a comma character. An attacker can exploit this if the target's authorized_keys file lists multiple principals and trusts a Certificate Authority (CA) that allows commas within the principal names it issues. This vulnerability specifically affects user-trusted CA keys in authorized_keys; the standard TrustedUserCAKeys and AuthorizedPrincipalsFile paths are not impacted. Successful exploitation allows an attacker to bypass intended principal restrictions and authenticate as a different user. The issue is resolved in OpenSSH 10.3.

Affected products

OpenBSD OpenSSH before 10.3

Timeline

2026-04-02: disclosed: Vulnerability disclosed in OpenSSH 10.3 release notes.
2026-04-02: patched: OpenSSH 10.3 released.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.