OpenSSH Parser Bug Turns CA Trust Into Root Access
A trusted SSH certificate can become a root credential when the parser splits a comma inside the principal name. The standard response is to treat this as a normal auth bug, but the real failure is trust boundary collapse: a CA-signed low-privilege identity can be accepted as root without a failed login trail.
CVE-2026-35414 affects OpenSSH versions prior to 10.3 and has been described as present across releases from the past 15 years. The flaw lets an attacker with a valid certificate from a trusted CA authenticate as root on a vulnerable server, and log-based detection is unreliable because the server treats the login as legitimate.
The risk shifts to certificate issuance and CA controls, not just server patching. If comma-bearing principals are allowed anywhere in the trust chain, the parser bug can turn ordinary identity strings into privilege escalation paths that leave little evidence behind.