Apache MINA SSHD: a server requiring two public keys accepts the same key twice, a partial auth bypass

Impact

A server configured to require two distinct public keys (the equivalent of OpenSSH's AuthenticationMethods "publickey,publickey") does not check that the two keys presented differ, so a client holding only one of the required key pairs authenticates by presenting it twice. This is a partial bypass: the attacker still needs one valid key, so it collapses two-key authentication back to one-key authentication rather than opening the service to strangers. It matters where MINA SSHD is the SSH front end of infrastructure services - Git review and SFTP endpoints, job-submission and data-movement gateways embedded in Java control-plane software - and where the second key was the compensating control for the first one being widely distributed or stored on a shared host. Node login on GPU hosts is OpenSSH and is not affected by this.

Who can reach it

Network, against a MINA SSHD server (up to 2.19.0, and 3.0.0-M1 through 3.0.0-M5) configured for multi-key authentication. The attacker must already hold one of the required private keys; no other credential is needed.

What to do

Upgrade the MINA SSHD dependency to 2.20.0 or 3.0.0-M6 and restart the Java service that embeds it - a service restart, not a host reboot or node drain. If you cannot rebuild immediately, understand the residual exposure precisely: the configuration still enforces one key, so rotating or revoking the key you believe is the weaker of the two is the useful interim step. The advisory names no mitigation inside the affected versions.

References

Related entries

• Linux kernel net/rds: teardown samples RDS_IN_XMIT instead of owning it, racing the transmit path into freed ring stateCVE-2026-98069 · Linux kernel net/rds (connection teardown vs transmit/refill fastpath locking)High
• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel KVM/arm64: guest-controlled TLBI Range can overflow the hypervisor's range computationCVE-2026-89911 · Linux kernel KVM arm64 (TLBI by Range)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh