CVE Catalog
CVE-2026-35388
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk0.13%
3th percentile - higher than 3% of all known CVEs
Summary
OpenSSH before version 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions, potentially allowing unauthorized access.
Risk Assessment
An attacker could exploit the missing confirmation to hijack a multiplexed session, leading to unauthorized system access.
Recommendation
Update OpenSSH to version 10.3 or later which enforces confirmation for proxy multiplexing.
Original NVD description (English source)
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.