CVE-2026-59996

Executive Summary

CVE-2026-59996 is a path traversal vulnerability in OpenSSH's scp utility, affecting versions prior to 10.4. The flaw allows a file to be placed in the parent directory of an intended destination directory when copying between two remote destinations. This logic flaw enables an attacker controlling either the source or destination SSH server to write files outside the intended target directory on a victim's local machine. With a CVSS score of 4.2 (Medium), the vulnerability requires specific copy conditions but can lead to unauthorized file placement, potentially enabling further exploitation such as overwriting configuration files or planting malicious content. All organizations using OpenSSH versions below 10.4 with scp remote-to-remote copy functionality are affected.

Technical Analysis

The vulnerability resides in the scp client component of OpenSSH, specifically in the code path that handles file transfers between two remote hosts (remote-to-remote copy). When a user executes a command such as:

scp user1@host1:/path/to/file user2@host2:/destination/dir/

The local scp client mediates the transfer by establishing an SSH connection to both endpoints. During the copy operation, scp constructs and executes remote commands (typically scp -f for source and scp -t for destination) over each SSH connection.

The flaw occurs in how the scp client parses and validates the path components received from the remote endpoints during the negotiation phase. When the destination directory path is passed to the remote scp process, insufficient validation is performed on directory traversal sequences (../) embedded within the path. Specifically, if a path contains a trailing slash followed by .. components, the scp client fails to normalize or reject the path before relaying it to the destination scp process.

The attack mechanism works as follows:

1. A malicious SSH server acts as either the source or destination endpoint in a remote-to-remote copy.
2. During protocol negotiation, the malicious server returns a crafted path string containing ../ traversal sequences — for example, instead of returning the requested file path, it responds with a path like ../../etc/cron.d/malicious.
3. The vulnerable scp client does not sanitize or validate this path before forwarding the copy command to the other remote endpoint.
4. The destination scp process receives the crafted path and writes the file to the resolved location — which may be outside the intended target directory.

The underlying issue is a failure to apply the same path canonicalization and .. component rejection that is performed for local-to-remote copies to the remote-to-remote code path. Code audits indicate the sanitize_path() function, which handles path normalization, was not invoked in the remote-to-remote transfer branch.

Attack surface: Any environment where users perform scp operations between two remote hosts. The attacker must control at least one of the two remote SSH servers involved in the transfer. Enterprise environments with automated scripts using remote-to-remote scp are most exposed.

Affected versions: All OpenSSH releases prior to 10.4. The fix was introduced in version 10.4, which includes proper path validation in the remote-to-remote code path.

Exploitation Scenarios

Scenario 1: Malicious Source Server (File Exfiltration & Plant)

Reconnaissance: The attacker operates an SSH server that appears legitimate (e.g., a file sharing service, CI/CD artifact repository). They identify target users who frequently copy files from this server to their internal infrastructure (e.g., a backup server or staging environment).

Weaponization & Trigger: The attacker configures their SSH server to respond with a crafted path when a scp request is received. When a victim executes:

scp attacker@malicious-server:/backup/output.txt backup-server:/var/backups/

The malicious server responds with the path ../../tmp/malicious.txt instead of the requested output.txt.

Execution: The vulnerable scp client on the victim's workstation relays this path to the destination backup server without sanitization. The destination scp process resolves the path relative to /var/backups/ but traverses upward to write the file to /tmp/malicious.txt (or to /etc/ with appropriate traversal sequences).

Post-exploitation: The attacker can now write arbitrary content (the contents of the requested file, or — more dangerously — if the source file is attacker-controlled, arbitrary payloads) to any location the destination SSH user can write. This could overwrite /etc/cron.d/ entries, replace SSH authorized keys, modify systemd units, or plant web shells.

Scenario 2: Malicious Destination Server (Privilege Escalation Vector)

Reconnaissance: The attacker controls a destination SSH server that receives uploads from internal users (e.g., a log aggregation server).

Weaponization & Trigger: When the victim executes scp internal-server:/data/report.txt attacker@malicious-server:/uploads/incoming/, the malicious destination server responds with a crafted acknowledgment containing a traversal path like ../../../../home/victim/.ssh/authorized_keys.

Execution: The vulnerable client forwards this path to the source server, which transfers the file to the traversed location on the destination. If the destination server runs with elevated privileges or the SSH user has permissions, the attacker achieves file placement outside the upload directory.

Post-exploitation: The attacker plants files in system directories, potentially creating a SSH backdoor by modifying authorized_keys with their own public key, enabling persistent access.

Scenario 3: Man-in-the-Middle (Automated Pipeline Poisoning)

Reconnaissance: In automated CI/CD pipelines that use scp for artifact distribution between build servers and deployment targets, the attacker compromises a network position (e.g., DNS spoofing or ARP poisoning) or a relay host.

Weaponization & Trigger: The attacker intercepts the scp session and replies with modified path responses during protocol negotiation.

Execution: The pipeline's scp command unknowingly writes build artifacts to attacker-chosen paths on the deployment target.

Post-exploitation: The attacker replaces legitimate deployment artifacts with malicious binaries or configuration files, leading to trojanized production deployments.

Impact Assessment

CVSS Score: 4.2 (Medium)

Attack Vector (AV): Network — the vulnerability is exploitable over the network via SSH protocol.

Attack Complexity (AC): High — requires specific conditions: remote-to-remote copy, attacker-controlled endpoint, and specific path traversal sequences that must navigate existing directory structures.

Privileges Required (PR): None — the attacker only needs to operate an SSH server; no prior authentication is required.

User Interaction (UI): Required — a victim must initiate an scp command between two remote destinations.

Business Impact:

• Confidentiality: Low-to-medium — an attacker can redirect file contents to unintended locations, potentially leaking sensitive data if the traversal causes files to be written to world-readable locations.
• Integrity: Medium — the primary impact; arbitrary file writes outside intended directories can overwrite configuration files, binaries, or scripts.
• Availability: Low — file corruption resulting from overwrites could cause service failures.

Affected Systems: All OpenSSH installations (client components) prior to version 10.4. This includes:

• Linux distributions (RHEL, Ubuntu, Debian, CentOS, etc.) using packaged OpenSSH
• BSD variants (OpenBSD, FreeBSD)
• macOS (which bundles OpenSSH)
• Windows (via Windows OpenSSH or Cygwin)
• Network appliances and embedded devices that bundle OpenSSH client tools

Blast Radius: Moderate. The vulnerability requires a specific usage pattern (remote-to-remote scp), which is less common than local-to-remote copies. However, in environments where this pattern is used in automation (backup scripts, CI/CD, data replication), the impact can be systemic. The write primitive, while constrained to the privileges of the SSH user, can be leveraged for lateral movement or persistence.

EPSS Percentile: 16.5% — indicates a relatively low current exploitation probability, but this may increase as details disseminate. CISA KEV does not currently list this CVE.

Detection Guidance

Sigma Rule

title: OpenSSH scp Remote-to-Remote Path Traversal Attempt
id: 3e7d9a22-2fbd-4f73-9e41-d01a4c218ad9
status: experimental
description: Detects scp commands with path traversal sequences in remote-to-remote copy operations, indicating possible CVE-2026-59996 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59996
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: process_creation
    product: linux
detection:
    selection_scp:
        Image|endswith: '/scp'
        CommandLine|contains|all:
            - 'scp'
            - '@'
    selection_remote_remote:
        CommandLine|contains|all:
            - '@'
    filter_local_single:
        CommandLine|regex: '^[^\s]+\s+[^\s]+@[^\s]+:[^\s]+\s+[^\s]+@[^\s]+:[^\s]+$'
    selection_traversal:
        CommandLine|contains:
            - '..%2f'
            - '..\\'
            - '../'
            - '%2e%2e'
    condition: selection_scp and selection_remote_remote and selection_traversal
    filter_local_only:
        CommandLine|re: '(?<!@)[\w.-]+:/(?!.*@)'
falsepositives:
    - Legitimate scp commands that copy files with names containing '..' (rare)
    - Administrative scripts that intentionally use relative path traversal
level: medium
tags:
    - attack.t1190
    - cve.2026-59996

YARA Rule

rule CVE_2026_59996_scp_path_traversal {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects scp client binaries with vulnerable remote-to-remote path handling (OpenSSH < 10.4)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59996"
        cve = "CVE-2026-59996"
        severity = "medium"
        date = "2026-01-15"
    strings:
        $sanitize_func = "sanitize_path" ascii nocase
        $remotetoremote_marker = "argv`" ascii
        $path_traversal = "../" ascii
        $version_string = "OpenSSH_9" ascii
        $version_string_10_0 = "OpenSSH_10.0" ascii
        $version_string_10_1 = "OpenSSH_10.1" ascii
        $version_string_10_2 = "OpenSSH_10.2" ascii
        $version_string_10_3 = "OpenSSH_10.3" ascii
    condition:
        uint16(0) == 0x457f and // ELF magic
        (($sanitize_func and $remotetoremote_marker) or $path_traversal) and
        ($version_string or $version_string_10_0 or $version_string_10_1 or
         $version_string_10_2 or $version_string_10_3) and
        not $version_string_10_4
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-59996 OpenSSH scp Remote-to-Remote Path Traversal Attempt"; flow:established,to_server; content:"scp"; nocase; pcre:"/scp\s+-[^\r\n]*@[^\s]+:[^\s]+\s+[^\s]+@[^\s]+:[^\s]*\.\.\//i"; reference:cve,2026-59996; classtype:attempted-admin; sid:20260001; rev:1;)

Elastic Detection

// EQL query to detect scp processes with path traversal in remote-to-remote commands
process where event.action == "exec" and
  process.name == "scp" and
  process.args : ["*@*:*", "*@*:*"] and
  process.args : ["*../*", "*..\\*", "*%2e%2e*"] and
  // Exclude local-only scp operations (no @ both sides)
  process.args where not all(args matches "*@*" only once)
  // EQL: check for at least two @ occurrences in args

Alternative Elasticsearch query:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "process.name": "scp" } },
        { "match": { "process.command_line": "./" } }
      ],
      "filter": [
        { "query_string": {
            "query": "process.command_line: (*@*. *@*.) AND process.command_line: (\"../\" OR \"..\\\" OR \"%2e%2e\")",
            "default_operator": "AND"
        } }
      ]
    }
  }
}

Splunk SPL Query

index=process sourcetype=ProcessRollup2 OR sourcetype=linux_audit
| where match(CommandLine, "^scp.*@.*:.*@.*:.*") 
| where match(CommandLine, "(\.\./|\.\.\\\\|%2e%2e)")
| eval has_traversal = if(match(CommandLine, "(\.\./|\.\.\\\\|%2e%2e)"), "YES", "NO")
| stats count by host, user, CommandLine, has_traversal
| where has_traversal == "YES"
| table _time, host, user, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="openssh,scp,path_traversal,">
  <rule id="912436" level="10" frequency="1">
    <decoded_as>sshd</decoded_as>
    <match>scp</match>
    <regex>scp\s+(\S+@\S+:\S+)\s+(\S+@\S+:\S+)</regex>
    <regex>(\S*)(\.\./|\.\.\\|%2e%2e)(\S*)</regex>
    <description>CVE-2026-59996: OpenSSH scp remote-to-remote path traversal attempt detected</description>
    <mitre><id>T1190</id><name>Exploit Public-Facing Application</name></mitre>
    <group>cve_2026_59996,path_traversal,openssh,</group>
    <options>no_full_log</options>
  </rule>

  <rule id="912437" level="6" frequency="5">
    <decoded_as>sshd</decoded_as>
    <match>scp</match>
    <description>CVE-2026-59996: Multiple scp remote-to-remote commands observed, potential scanning</description>
    <if_sid>59996</if_sid>
    <group>cve_2026_59996,openssh,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

Immediate Mitigations (before patching):

1. Restrict remote-to-remote scp usage: Disable scp remote-to-remote transfers at the organizational policy level. Redirect users to use sftp or rsync over SSH, which do not exhibit this vulnerability class.
2. Network controls: Implement egress filtering to restrict which external SSH servers internal users can connect to. Block direct SSH connections to arbitrary internet-facing servers unless explicitly required.
3. User awareness: Notify users to avoid copying files between two remote hosts. Encourage interim two-step copies (remote → local → remote) which are not vulnerable to this flaw.
4. Deploy vulnerable client detection: Use the Sigma/YARA rules above to audit your estate for OpenSSH versions prior to 10.4. Identify systems with automated scripts that use remote-to-remote scp.

Patch / Upgrade Steps:

1. OpenSSH 10.4 or later: Upgrade to OpenSSH 10.4, which includes the path sanitization fix in the remote-to-remote code path.
   • Source build: cd /usr/src && tar -xzf openssh-10.4.tar.gz && cd openssh-10.4 && ./configure && make && make install
   • Red Hat/CentOS/Fedora: yum update openssh or dnf update openssh
   • Debian/Ubuntu: apt update && apt upgrade openssh-client openssh-server
   • Alpine: apk upgrade openssh
   • FreeBSD: pkg upgrade openssh-portable or via ports: cd /usr/ports/security/openssh-portable && make update
   • macOS: brew upgrade openssh (or apply Apple's security update)
2. Confirm the fixed version: After upgrade, verify with ssh -V which should report version 10.4 or later.
3. Monitor for vendor advisories: Since patch confirmation is from a single source (OSV), actively monitor OpenSSH release announcements and your distribution's security advisories for confirmation and any backported patches for LTS distributions.

Long-Term Hardening:

1. Migrate away from scp: Standardize on sftp or rsync --rsh=ssh for all file transfer operations. Schedule the deprecation of scp in favor of these more secure alternatives.
2. Implement SSO and MFA: Reduce the impact of SSH credential compromise by requiring multi-factor authentication for all SSH access.
3. Principle of least privilege: Ensure SSH accounts have minimal filesystem write permissions. Use dedicated service accounts for automated transfers with restricted home directories and no write access to system paths.
4. Centralized logging: Enable and centralize SSH and scp audit logs. The detection rules in this report enable threat hunting for this CVE and related SSH file-transfer anomalies.
5. Regular vulnerability scanning: Include OpenSSH in your vulnerability management program. Track version numbers across all systems quarterly.
6. Network segmentation: Isolate backup/transfer servers on managed networks with strict host-based firewall rules. This limits the blast radius if a transfer endpoint is compromised.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-59996 — Official NVD record with CVSS scoring and description.
2. OpenSSH Release Notes: https://www.openssh.com/releasenotes.html — Version 10.4 changelog confirming the scp path traversal fix.
3. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-59996 — OSV advisory with affected package metadata and patch status (source of patch claim).
4. OpenSSH Official Site: https://www.openssh.com/ — Vendor homepage for source downloads and security announcements.
5. MITRE ATT&CK Database: https://attack.mitre.org/techniques/T1190/ — Reference for the "Exploit Public-Facing Application" technique.

Known Threat Actor Activity: As of this report, there is no confirmed exploitation in the wild, and CISA KEV does not list CVE-2026-59996. No specific threat actor campaigns have been attributed. However, the vulnerability class (path traversal in file transfer tools) has been historically exploited by APT groups for initial access and persistence (e.g., T1190 techniques). Security teams should treat this as an opportunistic exploitation candidate, particularly in sectors using automated SSH-based file transfers (financial services, healthcare, government). EPSS places this at the 16.5th percentile of exploited CVEs, suggesting low but non-zero immediate exploitation risk.