OpenSSH ssh client: NUL byte in an ssh:// URI can execute commands via ProxyCommand

Impact

The ssh client before 10.1 allows a '\0' character inside an ssh:// URI, which can lead to command execution when a ProxyCommand is configured. This is a distinct code path from the control-character username issue fixed in the same release: here the hostile input is a URI rather than a username. Operators are exposed wherever tooling hands an externally supplied ssh:// URI to the ssh client on a bastion, build runner or scheduler node - the command runs locally as the automation account before any remote authentication happens. Clusters that only ever call ssh with fixed hostnames from trusted config are not affected.

Who can reach it

Local. Requires something to pass an attacker-controlled ssh:// URI to the ssh client on a host that has ProxyCommand in effect. No credentials on the destination host are required.

What to do

Upgrade OpenSSH to 10.1p1 or a vendor backport. Client-side package update only - no daemon restart, node drain or reboot. Interim mitigation is to validate or reject ssh:// URIs that come from outside before invoking ssh. Siemens advisory SSA-019113 covers the affected SIMATIC S7-1500 MFP CPUs, which need their own firmware path.

References

Related entries

• OpenSSH sshd: the value "none" is sometimes treated as a filename instead of disabling the featureCVE-2026-106587 · OpenSSH sshd (configuration option value "none")Low
• OpenSSH ssh-agent: locking bypass lets a forwarded remote session add tokens and use keysCVE-2026-73281 · OpenSSH ssh-agent (agent locking vs session-bind@openssh.com extension)Low
• Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creatingCVE-2018-20855 · Linux kernel mlx5_ib (create QP response)Low
• Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selection: Setting Speculative Store Bypass Disable on AMD FamilyCVE-2022-42336 · Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selectionLow
• SSSD autofs responder: improper buffer offset during request parsing causes out-of-bounds read and crashCVE-2026-104029 · SSSD autofs responder (request buffer offset calculation)Low
• OpenSSH sshd: restrict in authorized_keys does not disable tunnel forwarding as documentedCVE-2026-106586 · OpenSSH sshd (restrict keyword in authorized_keys, tunnel forwarding)Low