Just a moment...
www.securityweek.com
  • icerunner_origin@startrek.websiteEnglish
    20·
    3 days ago

    Tracked as CVE-2026-35414 (CVSS score of 8.1), the flaw is described as a mishandling of the authorized_keys principals option in certain scenarios involving certificate authorities (CA) that use comma characters.

    According to Cyera, because of the bug, a comma in an SSH certificate principal name leads to OpenSSH access control bypass, allowing users to authenticate as root on a vulnerable server, as long as they have a valid certificate from a trusted CA.

    • Admiral Patrick@dubvee.orgEnglish
      8·
      3 days ago

      I was about to dive into that, so thanks for the breakdown. My fear was someone could just add a comma to any SSH cert and gain remote root.