Executive brief
Apache MINA SSHD is a Java library used to provide SSH (Secure Shell) capabilities to applications. A security flaw in how the library validates user certificates allows an attacker to bypass certain restrictions, such as 'forced commands' that are supposed to limit what a user can do once logged in. This could allow a restricted user to execute unauthorized commands on the server, potentially leading to full system access or data theft.
Technical details
A vulnerability exists in the server-side OpenSSH user certificate validation logic of Apache MINA SSHD. The library fails to check for or validate the 'force-command' or 'verify-required' options embedded within OpenSSH certificates. An attacker with a valid certificate containing these options can bypass intended command restrictions, executing arbitrary commands permitted by the underlying server implementation rather than being restricted to the command specified in the certificate. The issue is rooted in the lack of implementation for these specific OpenSSH certificate extensions. A fix is available in versions 2.19.0 and 3.0.0-M5, which now explicitly reject certificates containing these unsupported options.
Affected products
- Apache Software Foundation MINA SSHD 2.0.0 to 2.18.0, 3.0.0-M1 to 3.0.0-M4
Timeline
- 2026-07-20: disclosed
- 2026-07-20: advisory
- 2026-07-20: patched: Fixed in 2.19.0 and 3.0.0-M5