OpenSSH ssh client: shell metacharacters in a command-line username allow injection

Impact

A $ or \ character in a username passed to the ssh client on the command line is not neutralised, allowing injection through that argument. On a GPU fleet the practical exposure is automation rather than interactive use: job wrappers, Slurm prologs, Ansible-style fan-out scripts, health checkers and CI runners that build ssh user@host command lines from data a tenant or an upstream system can influence. Where such a path exists, the attacker gains execution in the context of whatever account runs the orchestration - frequently a management or root-equivalent account with key-based access to every node in the fleet. The record scores it local with user interaction required, so this is not a remotely triggerable flaw in sshd and does not expose the server side of SSH.

Who can reach it

Local - an attacker must be able to control or influence the username argument handed to the ssh client (for example a script that interpolates a user-supplied value). No authentication to the remote host is needed; the injection happens on the invoking side. The OpenSSH server (sshd) is not the affected component.

What to do

Update the OpenSSH client package to 10.6 or later, or to the distribution backport that carries the fix. This is a client-side binary: the new behaviour applies to the next ssh invocation, so no sshd restart, node drain or reboot is required. Until packages land, audit automation that builds ssh command lines from external data and validate or reject usernames containing $ and \. The release notes do not describe any further mitigation.

References

Related entries

• libvirt: integer overflow in NodeGetFreePages gives a local user heap corruption in the root daemonCVE-2026-18917 · libvirt (NodeGetFreePages RPC handler)High
• Linux KVM - irqfd routing type clobbered on deassign: Deassigning a KVM_IRQFD clobbers the irqfd's copy of theCVE-2026-23198 · Linux KVM - irqfd routing type clobbered on deassignHigh
• Linux kernel (net/xfrm): Closing an ESP-in-TCP socket cancels its transmit work item, but the write-space callback canCVE-2026-23239 · Linux kernel (net/xfrm)High
• Linux kernel perf: use-after-free on the perf ring buffer when mmap setup fails during a concurrent attachCVE-2026-23248 · Linux kernel perf/core (perf_mmap ring-buffer refcount)High
• Linux kernel perf: software events run the overflow path with IRQs enabled, racing teardown of the event's BPF programCVE-2026-23271 · Linux kernel perf (__perf_event_overflow vs perf_remove_from_context)High
• Linux kernel io_uring: task-work flag write can land on freed rings during a concurrent ring resizeCVE-2026-23275 · Linux kernel io_uring (ring resize vs task-work flag update)High