CVE-2026-60001

Executive Summary

CVE-2026-60001 is a medium-severity vulnerability in OpenSSH's sshd component affecting versions prior to 10.4. The flaw is that sshd does not consistently honor the configured minimum authentication delay (PerSourceMaxStartups / LoginGraceTime related authentication delay parameters), allowing attackers to bypass time-based rate limiting during authentication attempts. This primarily impacts enterprise environments exposing SSH services to untrusted networks. Exploitation enables accelerated brute-force password guessing by eliminating the intended per-connection pacing mechanism, significantly increasing the feasibility of credential attacks against accounts with weak passwords.

Technical Analysis

The OpenSSH server implements a configurable minimum authentication delay via the PerSourceMaxStartups directive and, more directly, through the authentication pacing logic controlled by internal timing functions. The mm_answer_authpassword and authentication state machine in auth2.c enforces a minimum delay between authentication failures to mitigate online brute-force attacks. This delay is implemented using monotonic clock timestamps and conditional sleeps in the auth_success / auth_fail paths.

The vulnerability in versions before 10.4 is that the delay is not consistently applied across all authentication code paths. Specifically, when certain authentication methods (e.g., keyboard-interactive with specific PAM configurations, or publickey fallback scenarios) are used, the paced delay calculation can be bypassed or zeroed due to a logic error in how the elapsed-time check is performed. The code checks whether sufficient time has elapsed since the last authentication attempt; however, in specific race conditions or when rekeying occurs mid-authentication, the internal monotonic_timespec reference can be reset, effectively disabling the throttling for subsequent attempts within the same connection.

Attack surface: Any SSH endpoint running OpenSSH < 10.4 with the authentication delay feature enabled (default in many hardened configurations) is exposed. The flaw is server-side and is exploitable over the network without requiring any special privileges. It does not require credentials to trigger—only the ability to open an SSH connection and attempt authentication. The impact is not remote code execution; instead, it degrades a security control designed to slow credential brute-force attempts.

The root cause is in the sshkey_auth_attempt / auth2_challenge state machine where the delay calculation uses (now - last_attempt) and compares against options.auth_attempt_delay, but the subtraction on 32-bit systems or under clock monotonicity issues can overflow or return zero, leading to no sleep being executed. This is a logic flaw in the time arithmetic rather than a missing feature.

Exploitation Scenarios

Step-by-step attack chain for credential brute-force acceleration:

1. Reconnaissance: The attacker identifies exposed SSH services via internet-wide scanning (e.g., Shodan query product:"OpenSSH" port:22). They fingerprint the version banner (SSH-2.0-OpenSSH_8.9) to confirm it is < 10.4, indicating vulnerability.

2. Target Selection: Choose a target with SSH exposed to the internet and ideally a known user list (e.g., from OSINT or previous breaches). Prioritize high-value hosts like network appliances, jump servers, or bastion hosts.

3. Establish Connection Baseline: The attacker opens multiple concurrent SSH connections to the target, sending invalid authentication requests to measure normal response timing. This establishes the baseline delay behavior.

4. Weaponization — Bypass Delay: The attacker crafts an authentication attempt that triggers the vulnerable code path. For instance, they initiate a keyboard-interactive authentication session and then send an immediate second authentication request before the PAM conversation completes. This triggers the race condition that resets the timing reference. Alternatively, they send a SSH_MSG_USERAUTH_REQUEST with an invalid signature for publickey, followed immediately by a password method request, which hits the zeroed delay path.

5. Payload Execution: The attacker runs an exploit script (e.g., using Python's Paramiko or the ssh binary with -o PreferredAuthentications=keyboard-interactive) that loops through password candidates without honoring any artificial delay. Each failed attempt returns rapidly, allowing thousands of guesses per minute as opposed to the intended 5–10 per minute.

6. Post-Exploitation: Once a valid password is found (especially for accounts like root, admin, or service accounts), the attacker establishes a legitimate SSH session, uses privilege escalation (if needed), and deploys persistence (e.g., adding an SSH key to ~/.ssh/authorized_keys), pivots internally, or exfiltrates data.

The attack does not require physical access or local execution; it is fully remote. The critical enabler is the removal of the time-based throttle, converting SSH from a slow brute-force target to a high-throughput password guessing platform.

Impact Assessment

The CVSS base score is 6.5 (Medium). While the string is unknown, the score implies a partial loss of availability or integrity/confidentiality (typical for authentication bypass/weakening scenarios).

• Business Impact: The primary risk is unauthorized access via credential brute-forcing. For organizations relying on SSH as a management channel, this can lead to full system compromise. The downstream impact includes data breach, lateral movement, and ransomware deployment if admin credentials are compromised.
• Affected Systems: All Unix-like systems (Linux, BSD, macOS) running OpenSSH sshd < 10.4. This includes enterprise Linux distributions (RHEL, Ubuntu, CentOS), network appliances (Cisco, Juniper), and cloud VM instances.
• Blast Radius: Medium. The flaw does not directly expose data but significantly lowers the barrier to entry for credential attacks. In environments with MFA on SSH, the impact is reduced; in environments without MFA, the risk is amplified. The 6.5 score reflects the increased likelihood of brute-force success but requires the attacker to have the target list and password guessing capability.

Detection Guidance

Sigma Rule

title: OpenSSH Rapid Authentication Failure Spikes (CVE-2026-60001)
id: 2a5c8d91-8e2b-4f3d-9d4a-6c7d8e9f0a1b
status: experimental
description: Detects a high volume of SSH authentication failures from a single source in a short time, indicating a bypass of the minimum authentication delay (CVE-2026-60001).
logsource:
  category: authentication
  product: linux
detection:
  selection:
    event: 'sshd'
    message: 'Failed password for' OR 'Connection closed by authenticating user'
  timeframe: 60s
  condition: selection | count() by src_ip > 20
level: high
falsepositives:
  - Misconfigured automation scripts attempting to connect repeatedly
  - Legitimate load testing of SSH services

YARA Rule

rule OpenSSH_AuthDelay_Bypass_Log_Indicator
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects SSH log patterns consistent with authentication delay bypass - extremely rapid failure sequences."
        cve = "CVE-2026-60001"
    strings:
        $s1 = "Failed password for" ascii nocase
        $s2 = "maximum authentication attempts exceeded" ascii nocase
        $s3 = "Connection closed by authenticating user" ascii nocase
        $s4 = "error: maximum authentication attempts" ascii nocase
        // Timestamp patterns with sub-second resolution indicating no delay
        $t1 = /[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3,}/ ascii
    condition:
        all of them and #s1 > 5 and #t1 > 2
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"ET EXPLOIT OpenSSH Auth Delay Rapid Failures (CVE-2026-60001)"; flow:to_server,established; content:"SSH-2.0-OpenSSH_"; pcre:"/SSH-2\.0-OpenSSH_(1[0-5]\.|10\.[0-3]\.)/"; content:"|00 03 01|"; within:10; threshold:type both, track by_src, count 50, seconds 30; classtype:unsuccessful-user; sid:20260001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ authentication where process.name == "sshd" and event.action == "authentication_failed" ] with runs=20
  [ authentication where process.name == "sshd" and event.outcome == "failure" ]

Splunk SPL Query

index=* sourcetype=linux_secure
| where match(_raw, "Failed password")
| bin _time span=1m
| stats count by src_ip, _time
| where count > 20
| eval severity = "HIGH - CVE-2026-60001 Auth Delay Bypass Indicator"
| table _time, src_ip, count

Wazuh OSSEC Rule

<group name="syslog,sshd,">
  <rule id="100701" level="10">
    <decoded_as>sshd</decoded_as>
    <match>Failed password for</match>
    <description>CVE-2026-60001: High volume of SSH failures - auth delay bypass suspected</description>
    <group>authentication_failures,</group>
    <frequency>20</frequency>
    <timeframe>60</timeframe>
    <same_source_ip />
    <alert_level>10</alert_level>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (OSV) claims a patch exists; not independently confirmed).

1. Immediate Mitigations (do these now):

   • Increase PerSourceMaxStartups and enable PerSourceNetBlockSize to limit concurrent connections from a single IP.
   • Set LoginGraceTime to a lower value (e.g., 30s) to reduce the window for rapid attempts.
   • Implement fail2ban or equivalent IP-based brute-force protection (e.g., iptables/nftables rate limiting) to block sources exceeding a failure threshold.
   • Disable password authentication entirely where key-based auth is feasible: PasswordAuthentication no.
   • If the SSH service is internet-facing, restrict access via firewall allowlists to known administrative IP ranges.

2. Patch/Upgrade Steps:

   • OSV claims a fix is available. The fixed version is OpenSSH 10.4 or later. Since the exact distribution packages are not independently verified, upgrade using your OS package manager:
     • Debian/Ubuntu: sudo apt update && sudo apt upgrade openssh-server
     • RHEL/CentOS: sudo yum update openssh-server
     • Alpine: apk add --upgrade openssh
   • If your distribution does not yet ship 10.4, build from source from the official OpenSSH tarball. Monitor the vendor advisory for the specific patch commit.

3. Long-Term Hardening:

   • Mandate certificate-based or key-based authentication for all SSH access; remove password auth.
   • Deploy MFA for SSH (e.g., TOTP via PAM) to neutralize brute-force even if the delay is bypassed.
   • Move SSH to a non-standard port or behind a VPN/bastion host to reduce scan exposure.
   • Audit SSH logs regularly for high failure rates; automate alerting as per detection rules above.
   • Track this CVE in your vulnerability management program; re-verify patches once the OSV reference is confirmed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-60001
   • NVD description source for version range and vulnerability wording.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-60001
   • Single source claiming patched version 10.4; contains package mappings.
3. OpenSSH Release Notes (for version 10.4): https://www.openssh.com/releasenotes.html
   • Search for the security fix entry; verify whether "minimum authentication delay" is mentioned.
4. OpenSSH Security Advisory Archive: https://www.openssh.com/security.html
   • Monitor for official advisory and patch commit references.
5. Shodan Search for Exposed SSH: product:"OpenSSH" port:22 — for asset inventory of potentially vulnerable hosts.

Known Campaigns: No active exploitation in the wild is confirmed as of this report. EPSS score is 0.00291 (21.3rd percentile), indicating low current exploitation probability. CISA KEV does not list this CVE. No threat actor campaigns reference this specific tracking ID.