Executive brief
A security flaw exists in libssh, a library used by applications to provide secure communication services. When a program uses this library to connect to a server using a specific proxy configuration, a specially crafted username can trick the system into executing unintended shell commands. This could allow a local attacker to view sensitive environment variables or interfere with how the application operates.
Technical details
A vulnerability exists in the ssh_check_username_syntax() function within src/misc.c of libssh. The validation path uses an incomplete filter for dangerous characters when expanding usernames through the %r token in ProxyCommand configurations. An attacker providing a specially crafted username containing shell metacharacters can influence shell expansion during ProxyCommand execution. This requires the client to combine untrusted username input with a ProxyCommand-style shell execution, leading to information disclosure of environment variables or unintended shell behavior.
Affected products
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Hardened Images affected
- libssh libssh
Timeline
- 2026-07-08: disclosed: Reported via Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date