CVE-2026-106586
Fixed in a distro release EPSS <1%CVSS 2.5
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
Products: openbsd openssh
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openssh | no fix |
| Debian 13 | openssh | no fix |
| Debian 14 | openssh | 1:10.6p1-1 |
| Debian 14 | openssh-gssapi | 1:10.6p1-1 |
| Red Hat hummingbird 1 | openssh | 0:10.5p1-1.2.hum1 |
| Red Hat hummingbird 1 | openssh-askpass | 0:10.5p1-1.2.hum1 |
| Red Hat hummingbird 1 | openssh-clients | 0:10.5p1-1.2.hum1 |
| Red Hat hummingbird 1 | openssh-keycat | 0:10.5p1-1.2.hum1 |
| Red Hat hummingbird 1 | openssh-keysign | 0:10.5p1-1.2.hum1 |
| Red Hat hummingbird 1 | openssh-server | 0:10.5p1-1.2.hum1 |
| Red Hat hummingbird 1 | openssh-sk-dummy | 0:10.5p1-1.2.hum1 |
| Ubuntu 18.04 LTS | openssh-ssh1 | no fix |
| Ubuntu 20.04 LTS | openssh-ssh1 | no fix |
| Ubuntu 22.04 LTS | openssh | 1:8.9p1-3ubuntu0.18 |
| Ubuntu 22.04 LTS | openssh-ssh1 | no fix |
| Ubuntu 24.04 LTS | openssh | 1:9.6p1-3ubuntu13.20 |
| Ubuntu 24.04 LTS | openssh-ssh1 | no fix |
| Ubuntu 26.04 LTS | openssh | 1:10.2p1-2ubuntu3.8 |
| Ubuntu 26.04 LTS | openssh-ssh1 | no fix |
| Ubuntu 26.10 | openssh | 1:10.5p1-1ubuntu3.1 |
| Ubuntu 26.10 | openssh-gssapi | 1:10.5p1-1ubuntu3.1 |
| Ubuntu 26.10 | openssh-ssh1 | no fix |
| Ubuntu Pro 14.04 LTS | openssh | no fix |
| Ubuntu Pro 16.04 LTS | openssh | no fix |
| Ubuntu Pro 18.04 LTS | openssh | no fix |
| Ubuntu Pro 20.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS-updates 18.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS-updates 20.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS-updates 24.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS 16.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS 18.04 LTS | openssh | no fix |
| Ubuntu Pro FIPS 20.04 LTS | openssh | no fix |