Vulnerabilities · 141 days ago

OpenSSH Parser Bug Turns CA Trust Into Root Access

A trusted SSH certificate can become a root credential when the parser splits a comma inside the principal name. The standard response is to treat this as a normal auth bug, but the real failure is trust boundary collapse: a CA-signed low-privilege identity can be accepted as root without a failed login trail.

CVE-2026-35414 affects OpenSSH versions prior to 10.3 and has been described as present across releases from the past 15 years. The flaw lets an attacker with a valid certificate from a trusted CA authenticate as root on a vulnerable server, and log-based detection is unreliable because the server treats the login as legitimate.

The risk shifts to certificate issuance and CA controls, not just server patching. If comma-bearing principals are allowed anywhere in the trust chain, the parser bug can turn ordinary identity strings into privilege escalation paths that leave little evidence behind.

CVE-2026-35414

NVD KEV

CVSS 4.2 MEDIUM: openSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals… EPSS 0.2% (7th percentile). Microsoft patch: CBL-Mariner Releases.

Timeline

Apr 27 Reported by SecurityWeek

Sources

1 source covering this story

SecurityWeek Apr 27
OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years
A code reuse issue enabled comma characters in certificate principals to be interpreted as list separators.

Entities

CVE-2026-35414

Part of the PlainSec briefing for 2026-04-27

Editions

Briefing for 2026-04-27

Vulnerabilities · 141 days agoOpenSSH Parser Bug Turns CA Trust Into Root AccessA trusted SSH certificate can become a root credential when the parser splits a comma inside the principal name. The standard response is to treat this as a normal auth bug, but the real failure is trust boundary collapse: a CA-signed low-privilege identity can be accepted as root without a failed login trail.CVE-2026-35414 affects OpenSSH versions prior to 10.3 and has been described as present across releases from the past 15 years. The flaw lets an attacker with a valid certificate from a trusted CA authenticate as root on a vulnerable server, and log-based detection is unreliable because the server treats the login as legitimate.The risk shifts to certificate issuance and CA controls, not just server patching. If comma-bearing principals are allowed anywhere in the trust chain, the parser bug can turn ordinary identity strings into privilege escalation paths that leave little evidence behind.