CVE-2026-56624

{
  "id": "CVE-2026-56624",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T21:16:49.070",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nServer-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server.\n\n\n\n\nThis issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions.\n\n\n\n\nThe fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*[email protected] user certificates (which are the only ones for which verify-required would make sense)."
    },
    {
      "lang": "es",
      "value": "Validación de certificado incorrecta en Apache MINA SSHD (lado del servidor). Apache MINA SSHD es una biblioteca Java para SSH del lado del cliente y del lado del servidor.\n\nLa validación de certificados de usuario de OpenSSH del lado del servidor durante la autenticación de usuario en un servidor Apache MINA SSHD no verificó las opciones no compatibles force-command o verify-required que podrían estar incrustadas en el certificado, ni validó estas opciones. Como resultado, fue posible que un usuario pudiera autenticarse con un certificado que incluía una opción force-command pero aún así pudo ejecutar otros comandos. Qué otro comando exactamente estaría disponible para el usuario depende de la implementación del servidor.\n\nEste problema está solucionado en Apache MINA SSHD 2.19.0 y 3.0.0-M5. Se aconseja a las aplicaciones actualizar a estas versiones.\n\nLa solución rechaza los certificados de usuario de OpenSSH que incluyen estas opciones, ya que Apache MINA SSHD no implementa ni force-command ni los certificados de usuario sk-*[email protected] (que son los únicos para los que verify-required tendría sentido)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache MINA SSHD",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.sshd:sshd-core",
          "versions": [
            {
              "version": "2.0.0",
              "lessThanOrEqual": "2.18.0",
              "versionType": "maven",
              "status": "affected"
            },
            {
              "version": "3.0.0-M1",
              "lessThanOrEqual": "3.0.0-M4",
              "versionType": "maven",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T00:00:00+00:00",
          "id": "CVE-2026-56624",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:mina_sshd:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.19.0",
              "matchCriteriaId": "93103A71-FB42-4C50-8529-232D40EAD7DD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m1:*:*:*:*:*:*",
              "matchCriteriaId": "32435A6F-3BD6-4AAB-93B1-0B1514419A50"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m2:*:*:*:*:*:*",
              "matchCriteriaId": "0E399FD6-9A33-4F78-AFCE-F46C7BBC56F1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m3:*:*:*:*:*:*",
              "matchCriteriaId": "13419EBE-E6B4-4895-BF6C-FC910076CC7A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:mina_sshd:3.0.0:m4:*:*:*:*:*:*",
              "matchCriteriaId": "1B2D4A4D-BEF5-416F-91AD-B4F278B04C76"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Mailing List"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}