CVE-2026-59999: High severity OpenSSH sshd vulnerability
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.8p1-9 - Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:10.4p1-1 - Upgrade
Upgrade
OpenSSH (sshd)to a version that resolves this vulnerability.Fixed in 10.4 - Configuration
Set DisableForwarding=yes so forwarding is disabled.
sshd (OpenSSH) DisableForwarding = yes - Configuration
Set PermitTunnel=no to prevent tunnels, since DisableForwarding=yes did not correctly override PermitTunnel=yes in OpenSSH before 10.4.
sshd (OpenSSH) PermitTunnel = no
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59999?
The severity of CVE-2026-59999 is classified as medium with a score of 5.9.
How do I fix CVE-2026-59999?
To fix CVE-2026-59999, upgrade to OpenSSH version 10.4 or later where the vulnerability is addressed.
What types of attacks does CVE-2026-59999 make possible?
CVE-2026-59999 may allow for unintended tunneling because DisableForwarding=yes was not properly enforced when PermitTunnel=yes is set.
Which software is affected by CVE-2026-59999?
CVE-2026-59999 affects the sshd component of OpenSSH prior to version 10.4.
What does DisableForwarding=yes do in OpenSSH related to CVE-2026-59999?
In OpenSSH, DisableForwarding=yes is intended to prevent port forwarding, but CVE-2026-59999 shows that it did not take precedence over PermitTunnel=yes.