Bug 2503053 (CVE-2026-56624)

Summary:	CVE-2026-56624 org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abrianik, ant, anujha, aschwart, asoldano, aszczucz, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, bstansbe, cescoffi, dandread, dkreling, dlofthou, drichtar, fmariani, fmongiar, ggrzybek, gmalinko, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, jnethert, jraez, jwon, lthon, manderse, mcarlett, mosmerov, mposolda, msvehla, nwallace, olubyans, parichar, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rhel-process-autobot, rmartinc, rruss, rstancel, rstepani, rsvoboda, sbiarozk, ssilvert, sthorger, tasato, tcunning, thjenkin, tqvarnst, vdosoudi, vmuzikar, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-20 21:02:10 UTC

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH.




Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.




This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.




The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01 user certificates (which are the only ones for which verify-required would make sense).

Comment 3 errata-xmlrpc 2026-08-13 23:28:25 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:54776 https://access.redhat.com/errata/RHSA-2026:54776

Comment 4 Jon Orris 2026-09-24 19:56:54 UTC

This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Via RHSA-2026:71675 https://access.redhat.com/errata/RHSA-2026:71675