The version of OpenSSH installed on the remote host is prior to 10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.3 advisory.

  - In OpenSSH before 10.3, validation of shell metacharacters in user names supplied on the command-line     was performed too late, allowing potential expansion from %-tokens in ssh_config. For configurations     that use a %u token in a Match exec block, an attacker who can control the user name passed to ssh(1)     could potentially execute arbitrary shell commands. (CVE-2026-35386)

  - In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary     to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and     without -p (preserve mode). (CVE-2026-35385)

  - OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in     PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
    (CVE-2026-35387)

  - In OpenSSH before 10.3, connection multiplexing confirmation (requested using ControlMaster ask/autoask)     was not being tested for proxy mode multiplexing sessions (i.e. ssh -O proxy ...). (CVE-2026-35388)

  - OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a     principals list in conjunction with a Certificate Authority that makes certain use of comma characters.     (CVE-2026-35414)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

OpenSSH < 10.3 Multiple Vulnerabilities

high Nessus Plugin ID 306743

Version 1.2