CVE-2026-35385: High severity Microsoft azl3 openssh 9.8p1-5 vulnerability
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:8.4p1-5+deb11u7Fixed in 1:9.2p1-2+deb12u10Fixed in 1:10.0p1-7+deb13u4Fixed in 1:10.3p1-5Fixed in 1:10.4p1-1 - Configuration
When using scp as root, avoid the combination of legacy scp protocol (-O) and not preserving file mode (-p is omitted). Use scp without -O, or include -p (preserve mode) to prevent downloaded files from becoming setuid/setgid.
scp (OpenSSH) Flags: -O and -p = Do not use legacy -O scp protocol when running scp as root, and avoid omitting -p (i.e., use -p to preserve modes)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35385?
CVE-2026-35385 is considered a moderate severity vulnerability affecting OpenSSH prior to version 10.3.
How do I fix CVE-2026-35385?
To fix CVE-2026-35385, upgrade OpenSSH to version 10.3 or later.
What impact does CVE-2026-35385 have on system security?
CVE-2026-35385 can lead to unexpected setuid/setgid permissions on files downloaded using scp as root.
Who is affected by CVE-2026-35385?
Any users or administrators utilizing OpenSSH versions before 10.3 with legacy scp protocol are affected by CVE-2026-35385.
Is CVE-2026-35385 a zero-day vulnerability?
No, CVE-2026-35385 is not a zero-day vulnerability as it has been publicly disclosed and patches are available.