CVE 2026 35414

nvd.nist.gov • April 29, 2026

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OpenSSH Vulnerability Allows Root Access (CVE-2026-35414) A high severity vulnerability (CVE-2026-35414) in OpenSSH has been identified, allowing attackers to bypass authentication and gain root access to affected servers. This flaw affects all OpenSSH versions prior to 10.3 and has been present for over 15 years. Exploitation requires a valid certificate from a trusted Certificate Authority, and successful attacks may not leave traces in logs, complicating detection efforts. Organizations are urged to update to version 10.3 or later immediately to mitigate risks. The vulnerability was publicly disclosed on April 2, 2026, with proof of concept released on April 29, 2026. No active exploitation has been reported yet, but the potential for significant damage exists. Security experts recommend enhancing monitoring and detection capabilities to identify any suspicious activities related to this vulnerability. 3 sources 72

Extracted Entities

Platforms (1)

OpenSSH