CVE-2026-106589

🗓️ 06 Oct 2026 21:21:35Reported by mitreType

Privilege escalation in OpenSSH sshd as root on QNX 6 and SCO OpenServer 5.

Reporter	Title	Published	Views	Family All 17
Cvelist	CVE-2026-106589	6 Oct 202621:21	–	cvelist
Debian CVE	CVE-2026-106589	6 Oct 202621:21	–	debiancve
EUVD	EUVD-2026-94055	7 Oct 202600:31	–	euvd
Mend	CVE-2026-106589	6 Oct 202621:21	–	mend
Microsoft CVE	In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.	8 Oct 202608:13	–	mscve
NVD	CVE-2026-106589	6 Oct 202622:17	–	nvd
osv_azl	AZL-106697 CVE-2026-106589 affecting package openssh 9.8p1-10	6 Oct 202622:17	–	osv_azl
osv_bell	BELL-CVE-2026-106589 CVE-2026-106589 does not affect BellSoft software	9 Oct 202606:09	–	osv_bell
osv_debian	DEBIAN-CVE-2026-106589	6 Oct 202622:17	–	osv_debian
osv_echo	ECHO-F8B1-1C2F-484D QNX 6 / SCO OpenServer 5 only. sshd-session can keep root privileges on platforms that lack file-descriptor passing and need root for PTY allocation, via GatewayPorts and StreamLocalForwarding. Linux supports file-descriptor passing, so this code path is not used in Echo's build. OpenSSH 10.6 also forcibly disables those options on the affected platforms. https://www.openssh.com/releasenotes.html#10.6 https://security-tracker.debian.org/tracker/CVE-2026-106589	7 Oct 202614:12	–	osv_echo

Vulners

CNA

Node

openbsd opensshRange0–10.6

[
  {
    "defaultStatus": "unknown",
    "product": "OpenSSH",
    "vendor": "OpenBSD",
    "versions": [
      {
        "lessThanOrEqual": "10.6",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openssh	www.openssh.org/releasenotes.html

07 Oct 2026 16:17Current

6Medium risk

Vulners AI Score6

CVSS 3.12.9

EPSS0.00082

SSVC

CWE-272