Is CVE-2026-59846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59846 being exploited in the wild.

How severe is CVE-2026-59846?

Low severity, with a CVSS score of 3.9, published 21 July 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected.

Is there a fix for CVE-2026-59846?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59846 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-59846?

Check whether you run Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59846: libssh shell metacharacter injection in ProxyCommand username expansion

CVE-2026-59846 · Severity: low · CVSS 3.9 · Published 2026-07-21

A security flaw exists in libssh, a library used by applications to provide secure communication services. When a program uses this library to connect to a server using a specific proxy configuration, a specially crafted username can trick the system into executing unintended shell commands. This could allow a local attacker to view sensitive environment variables or interfere with how the application operates.

Technologies: Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Libssh, Red Hat.

Quick answers

Is CVE-2026-59846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59846 being exploited in the wild.
How severe is CVE-2026-59846?: Low severity, with a CVSS score of 3.9, published 21 July 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected.
Is there a fix for CVE-2026-59846?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59846 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-59846?: Check whether you run Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the ssh_check_username_syntax() function within src/misc.c of libssh. The validation path uses an incomplete filter for dangerous characters when expanding usernames through the %r token in ProxyCommand configurations. An attacker providing a specially crafted username containing shell metacharacters can influence shell expansion during ProxyCommand execution. This requires the client to combine untrusted username input with a ProxyCommand-style shell execution, leading to information disclosure of environment variables or unintended shell behavior.

Affected products

Red Hat Red Hat Enterprise Linux 8 affected
Red Hat Red Hat Enterprise Linux 9 affected
Red Hat Red Hat Enterprise Linux 10 affected
Red Hat Red Hat Hardened Images affected
libssh libssh

Timeline

2026-07-08: disclosed: Reported via Red Hat Bugzilla
2026-07-21: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.