CVE-2026-110925

Executive Summary

CVE-2026-110925 is a command injection flaw (CWE-78) in OpenSSH in which a username supplied on the ssh command line may contain a $ character or a non-trailing backslash. When a configuration later expands the %u token inside ProxyCommand or Match exec, those characters are passed into the shell, enabling shell metacharacter interpretation. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium), reflecting network attack vector, high attack complexity relief (AC:L), no privileges, required user interaction, and low confidentiality and integrity impact. Any environment where client-side OpenSSH configuration uses %u in ProxyCommand or Match exec directives is potentially affected; no affected version range has been published, no public proof-of-concept exists, and no vendor patch is currently available.

Technical Analysis

The flaw resides in the interaction between the OpenSSH client's handling of the username argument and the later expansion of the configuration token %u. OpenSSH configuration directives such as ProxyCommand and Match exec support token expansion, where %u is substituted with the current username. The client accepts a username on the command line that can still contain a $ character or a backslash (unless the backslash is trailing). When the %u token is expanded within ProxyCommand or Match exec, the resulting string is passed to a shell. Shell metacharacters embedded in the username are then subject to shell interpretation rather than being treated as inert literal text.

The vulnerability class is OS command injection (CWE-78): user-controllable input reaches a shell without adequate sanitization or escaping. The attack surface is the OpenSSH client invocation path, specifically ssh command-line username input, combined with configuration directives that expand %u into a shell context. The CVSS vector indicates Attack Vector Network (AV:N) and User Interaction Required (UI:R), consistent with a scenario in which a victim user or an automated client process connects using the affected configuration while the username value is influenced by an attacker — for example through a crafted host alias, wrapper script, provisioning template, or data source that supplies the username.

The scores reflect low confidentiality (C:L) and low integrity (I:L) impact with no availability impact (A:N) and an unchanged scope (S:U). No public proof-of-concept, exploit code, or Nuclei template has been observed, and no affected version list has been published. Because specific code paths, function names, and patch diffs are not available in the source intelligence, the analysis is scoped to the documented mechanism: username characters ($, non-trailing backslash) surviving into shell-bound %u expansions.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the documented token-expansion mechanism.

1. Reconnaissance / target identification — An attacker identifies a target environment where the OpenSSH client is invoked with a user-controlled or indirectly influenceable username and where the client configuration uses %u inside ProxyCommand or Match exec. This could be a host whose alias resolution, wrapper scripts, or automation inputs allow the username argument to be dictated by data the attacker influences.

2. Triggering the flaw class — The attacker supplies a username value containing a $ character or a non-trailing backslash on the ssh command line. Because the client accepts these characters in the username, the value is retained and later substituted into the %u token when ProxyCommand or Match exec is expanded.

3. Payload / execution method — The expanded configuration string is passed into the shell. Shell metacharacters present in the username are interpreted by the shell rather than treated as literal text. At the vulnerability-class level, this is command injection: an attacker who controls the username content can cause shell interpretation of injected characters within the context of the user's shell when ProxyCommand or Match exec executes. No specific payload strings or code patterns are published, so injection payload construction is not specified here.

4. Post-exploitation impact — Successful injection results in command execution with the privileges of the OpenSSH client process (the connecting user). The CVSS subscores indicate low confidentiality and low integrity impact with no availability impact, meaning the likely consequence is limited information disclosure and/or limited modification of data or command outcomes reachable from that shell context, rather than full system compromise. Scope is unchanged, so the impact is contained to the vulnerable client component's security authority.

Impact Assessment

Business impact stems from command execution on systems that run the OpenSSH client with %u-expanding configuration directives and attacker-influenceable usernames. The base score of 5.4 (Medium) and the subscores (C:L, I:L, A:N, S:U) indicate a bounded blast radius: low confidentiality and integrity impact and no availability impact. Exploitation requires user interaction (UI:R), which limits opportunistic mass exploitation. Affected systems are those where operators or automation rely on ProxyCommand or Match exec with %u expansion; environments that never use %u in these directives are not exposed by this mechanism. Because no affected version range is published, the full population of vulnerable deployments cannot be enumerated from available data. There is no evidence of CISA KEV listing, no known exploit code, and no EPSS score (not yet scored by FIRST.org at the time of writing).

Detection Guidance

Sigma Rule

title: OpenSSH Username Command Injection via %u Expansion in Client Config
id: 7b3c1e94-0f2a-4d6e-9c11-2a5f8b0d4c77
status: experimental
description: Detects ssh client invocations with usernames containing shell metacharacters
  ($ or backslash) that could be expanded via %u in ProxyCommand or Match exec.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110925
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/ssh'
  selection_user:
    CommandLine|contains:
      - '$('
      - '${'
      - '`'
      - '\'
  filter_legit:
    CommandLine|contains:
      - 'ProxyCommand'
      - 'Match exec'
  condition: selection_img and selection_user
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Administrative scripts passing unusual username strings
  - Backup or automation tooling using non-standard account identifiers
level: medium

YARA Rule

rule CVE_2026_110925_OpenSSH_Username_Injection
{
    meta:
        description = "Detects OpenSSH client configuration lines expanding %u inside ProxyCommand or Match exec, and suspicious ssh invocation strings containing shell metacharacters in usernames"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110925"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cfg_proxy = "ProxyCommand" ascii nocase
        $cfg_match = "Match exec" ascii nocase
        $token_u   = "%u" ascii
        $meta_dollar = "$(" ascii
        $meta_brace  = "${" ascii
        $meta_tick   = "`" ascii
        $bslash      = "\\" ascii

    condition:
        (
            ($cfg_proxy or $cfg_match) and $token_u and
            ($meta_dollar or $meta_brace or $meta_tick or $bslash)
        )
}

Suricata IDS Rule

alert ssh any any -> any any (msg:"CVE-2026-110925 OpenSSH username command injection attempt via %u expansion"; flow:to_server,established; content:"SSH-2.0-"; depth:8; content:"|24 28|"; within:256; classtype:attempted-user; reference:cve,2026-110925; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110925; sid:2026110925; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: SSH encrypts session content after the initial banner, so network-layer detection of the injected username is limited to unencrypted pre-authentication exchanges and telemetry that decodes the transport. The rule above targets observable cleartext banner/metadata channels and should be complemented by endpoint process-creation detection.

Elastic Detection

process where event.type == "start" and process.name == "ssh" and
  process.args : "*$(*" or process.args : "*${*" or process.args : "*`*" or process.args : "*\\*"

Splunk SPL Query

index=endpoint (process_name=ssh OR process_name=ssh.exe)
| eval cmd=coalesce(process_command_line, CommandLine)
| where match(cmd, "\$\(|\$\{|`|\\\\")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, cmd
| where count >= 1
| table host, user, cmd, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="openssh,cve_2026_110925,">
  <rule id="2026110" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">ssh</field>
    <field name="process.args">\$\(|\$\{|`|\\</field>
    <description>CVE-2026-110925: OpenSSH client invoked with shell metacharacters in username, potential %u command injection.</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, no vendor fix is identified, and no affected version range has been published. There is no vendor advisory or workaround in the supplied intelligence.

1. Immediate mitigations — Avoid supplying usernames containing $ or backslash characters on the ssh command line. Where possible, eliminate or harden the use of %u inside ProxyCommand and Match exec directives, since the vulnerability manifests only when %u is expanded into a shell context. Review client configurations for %u usage and substitute static or validated values where operationally feasible. Ensure usernames in automation, provisioning templates, and alias definitions are strictly validated against an allowlist that excludes shell metacharacters.

2. Patch / upgrade steps — No patch is currently available (patch confidence 0/4, patch sources empty). Track the OpenSSH project and vendor advisories for an official fix; apply the fixed release when published. Because no affected version range has been published, maintain an inventory of deployed OpenSSH client versions and be prepared to upgrade once a fixed version is identified.

3. Long-term hardening — Treat configuration-token expansion as a shell-input boundary: prefer configurations that do not route user-controlled values into ProxyCommand or Match exec shell contexts. Enforce input validation on any username values generated by scripts or tooling. Limit the privileges and reachable data of accounts used for automated SSH connections so that successful injection yields minimal confidentiality and integrity impact. Monitor process-creation telemetry for ssh invocations containing shell metacharacters, as described in the detection guidance above.

References

• NVD — CVE-2026-110925: https://nvd.nist.gov/vuln/detail/CVE-2026-110925
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• OpenSSH project (monitor for official advisory and fixed release): https://www.openssh.com/
• CISA Known Exploited Vulnerabilities Catalog (no KEV entry for this CVE as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns and no exploit-in-the-wild evidence have been reported for CVE-2026-110925. No EPSS score is currently published by FIRST.org.