OpenSSH ssh client: control characters in untrusted usernames can execute commands via ProxyCommand

Impact

The ssh client before 10.1 accepts control characters in usernames that come from the command line or from %-sequence expansion in a config file, and those characters can survive into a ProxyCommand, turning a hostile username into shell command execution on the machine running ssh. On a GPU fleet this matters wherever ssh invocations are built from data an operator does not fully control: job scripts that template a user into a jump-host ProxyCommand, Slurm prologs, orchestration glue that shells out to ssh with an attacker-influenced target. Execution lands in the context of whatever account drives the automation, which on a management or login host is often broadly privileged across the cluster. Fleets that use plain literal usernames in ssh_config and never pass usernames in from outside are not exposed.

Who can reach it

Local, and only through a path that feeds an attacker-chosen username into ssh on the command line or into a %-expanded config value, with a ProxyCommand in effect. No authentication to the remote host is needed - the command runs before the connection is established. A config file that hardcodes a complete literal username is not an exposed source.

What to do

Upgrade OpenSSH to 10.1p1 or a distribution backport. The client is not a long-running daemon, so this is a package update with no node drain or reboot needed; already-running sessions are unaffected and new invocations pick up the fix. Until patched, stop interpolating untrusted usernames into ssh command lines and ProxyCommand templates. Siemens has published a product advisory for affected SIMATIC devices; follow it separately for embedded equipment.

References

Related entries

• OpenSSH ssh client: NUL byte in an ssh:// URI can execute commands via ProxyCommandCVE-2025-61985 · OpenSSH ssh client (NUL byte in ssh:// URI reaching ProxyCommand)Low
• OpenSSH sshd: the value "none" is sometimes treated as a filename instead of disabling the featureCVE-2026-106587 · OpenSSH sshd (configuration option value "none")Low
• OpenSSH ssh-agent: locking bypass lets a forwarded remote session add tokens and use keysCVE-2026-73281 · OpenSSH ssh-agent (agent locking vs session-bind@openssh.com extension)Low
• Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creatingCVE-2018-20855 · Linux kernel mlx5_ib (create QP response)Low
• Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selection: Setting Speculative Store Bypass Disable on AMD FamilyCVE-2022-42336 · Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selectionLow
• SSSD autofs responder: improper buffer offset during request parsing causes out-of-bounds read and crashCVE-2026-104029 · SSSD autofs responder (request buffer offset calculation)Low