Red HatCVE-2026-59846
Red Hat libssh: command injection
Low3.9CVE-2026-59846 · Published Jul 21, 2026 · updated Sep 1, 2026
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-78, CWE-77
- www.cve.org/CVERecord?id=CVE-2026-59846
- nvd.nist.gov/vuln/detail/CVE-2026-59846
- access.redhat.com/errata/RHSA-2026:42922
- access.redhat.com/errata/RHSA-2026:55855
- access.redhat.com/errata/RHSA-2026:62217
- access.redhat.com/errata/RHSA-2026:62218
- access.redhat.com/security/cve/CVE-2026-59846
- bugzilla.redhat.com/show_bug.cgi?id=2498179
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 21 | Red Hat libarchive: integer overflow | Low2.9 | No fix yet |
| Jul 21 | Red Hat Enterprise Linux 10: information disclosure | Low3.4 | No fix yet |
| Jul 21 | Red Hat Enterprise Linux 10: out-of-bounds read | Medium4.2 | No fix yet |
| Jul 21 | Red Hat ansible-core: argument injection | High7.8 | No fix yet |
| Jul 21 | Red Hat libssh. Logic errors: denial of service | Low3.1 | No fix yet |
| Jul 21 | Red Hat libssh: use after free | Medium4.3 | No fix yet |