CVE-2026-106552
OpenSSH: path traversal
- Risk score
- 55/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
- Affected
- OpenSSH before 10.6
- Fix
- Upgrade OpenSSH to 10.6 or later.
- Exploitation
- No known exploitation
Story map
At a glance
OpenSSH: Amber, patch this week. In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
The flaws
- CVE-2026-106552: Path traversal (CVSS 6.5 · EPSS 0%)
- CVE-2026-106553: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a… (CVSS 7.5 · EPSS 0%)
- CVE-2026-106555: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be… (CVSS 7.5 · EPSS 0%)
- CVE-2026-106583: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to… (CVSS 7.8 · EPSS 0%)
The fix
Upgrade OpenSSH: 10.6 or later on your release line
Who is exposed: OpenSSH before 10.6
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-23). 26 other warnings in 30 days
- Same product: Earlier OpenSSH warnings. 5 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: openssh
References
Original description
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
Last activity 6 Oct 2026. Patch Forecast updates every hour.