Bug#1132576: openssh: CVE-2026-35414

Salvatore Bonaccorso <[email protected]> Fri, 03 Apr 2026 10:59:00 +0200

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<177520674098.223254.7581151223820520612.reportbug__7489.81448575563$1775206829$gmane$org@eldamar.lan>

Source: openssh
Version: 1:10.2p1-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for openssh.

CVE-2026-35414[0]:
| OpenSSH before 10.3 mishandles the authorized_keys principals option
| in uncommon scenarios involving a principals list in conjunction
| with a Certificate Authority that makes certain use of comma
| characters.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35414
    https://www.cve.org/CVERecord?id=CVE-2026-35414
[1] https://www.openssh.org/releasenotes.html#10.3p1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore