OpenSSH 10.6 security fixes: sftp path escape, compression side channel, ProxyCommand username injection and more

What happened

OpenSSH 10.6 was released on 6 October 2026 with a list of security fixes. The release notes give no CVE IDs (OpenSSH). MITRE assigned them the same day; all are rated low or medium, and CISA’s ADP marks exploitation as “none” (CVE-2026-106552). The OpenSSH team also says it now gets many AI-assisted bug reports, has seen AI-found bugs independently rediscovered by others, and will release more often as a result.

The fixes that matter most to defenders:

• sftp recursive copy escape (CVE-2026-106552, CVSS 4.2). A malicious server could return paths that make a recursive copy write outside its target directory. Reported by Junghoon Cho.
• Compression side channel (CVE-2026-106582). With compression on, all channels in one SSH connection share one LZ77 dictionary. An attacker who can send data through one channel can recover secrets from another, by watching ciphertext lengths. OpenSSH credits the paper “Crossing the Streams” by Fabian Baumer and Marcus Brinkmann, preprint arXiv 2609.07709. OpenSSH disabled the LZ77 dictionary coder, which makes the Compression option less effective.
• Username injection (CVE-2026-106583). ssh now refuses $ and \ in usernames given on the command line. A username from an untrusted source could inject shell commands through ProxyCommand, Match exec and similar options. Usernames set with User in config files are not checked. Reported by SecBuddyF KeenLab Tencent.
• Decompression bomb (CVE-2026-106585, CVSS 6.5). Compressed payloads could inflate past the maximum packet length. Reported by Oleh Konko.
• GSSAPI state (CVE-2026-106553, CVE-2026-106555). Credentials from a failed GSSAPI attempt could persist and become available after a later successful login. Reported by Moritz Theile.
• restrict and tunnels (CVE-2026-106586). The restrict keyword in authorized_keys was not applied to tunnel forwarding (PermitTunnel, off by default).
• “none” in Match blocks (CVE-2026-106587). Options such as AuthorizedPrincipalsFile that accept none treated it as a literal file name when set inside a Match block. Found by Chris Rohlf “in collaboration with Claude and Anthropic Research”.
• ssh-keygen dates (CVE-2026-106584). Daylight Saving Time handling could give certificates the wrong expiry time.

CVE mapping is from Ubuntu’s notice USN-8937-1 and the CVE records (Ubuntu). Two further changes have no CVE: on platforms without file descriptor passing (QNX 6, SCO OpenServer 5, builds with --disable-fd-passing), GatewayPorts and StreamLocalForwarding are now forced off; and sandboxing is no longer supported on macOS SDK 27 and later (OpenSSH).

Am I affected?

Every OpenSSH before 10.6 is affected, unless your distribution backported the fixes. Check the version and, on distributions that backport, ask by CVE:

ssh -V
dpkg -l openssh-client openssh-server      # Debian, Ubuntu
rpm -q openssh openssh-server              # RHEL, Fedora, SUSE
dnf updateinfo list --cve CVE-2026-106552  # RHEL family

On Ubuntu 26.10 the fix is package version 1:10.5p1-1ubuntu3.1 (Ubuntu).

Check the settings that decide whether the riskier bugs reach you:

# Server: is compression on, is GSSAPI or tunnelling in use?
sudo sshd -T | grep -iE '^(compression|gssapiauthentication|permittunnel) '

# Client: compression and connection sharing for a given host
ssh -G host.example.com | grep -iE '^(compression|controlmaster|controlpath) '

# Scripts that build ssh usernames from variables
grep -rnE 'ssh[^|]*\$\{?[A-Za-z_]+\}?@' --include='*.sh' --include='*.py' --include='*.yml' .

The compression side channel needs compression on and several channels sharing one connection, for example ControlMaster multiplexing or port forwards alongside a shell.

What to do now

1. Update OpenSSH to 10.6 or your distribution’s fixed package on servers, bastion hosts, CI runners and developer machines. Restart sshd so the new binary is running.
2. Do not run sftp -r or get -R against untrusted servers on older clients. The path escape is in the client, so updating servers does not help.
3. Turn off compression where trusted and untrusted traffic share a connection. Set Compression no on clients and in sshd_config. OpenSSH recommends compressing at the application level instead, which is “completely immune to this type of attack” (OpenSSH).
4. Stop passing untrusted input to ssh as a username. OpenSSH says the new check “can not be absolute given the variety of shells and user configurations in use”. Validate usernames against an allow-list in scripts and CI jobs that build ssh user@host from external data, especially where ProxyCommand or Match exec is configured.
5. Expect two behaviour changes after updating. Command-line usernames with $ or \ will be refused (usernames set with User in a config file still work), and Compression yes will compress less.

Sources

• OpenSSH release notes: OpenSSH 10.6
• Ubuntu USN-8937-1: OpenSSH vulnerabilities
• CVE-2026-106552 record
• CVE-2026-106582 record
• CVE-2026-106583 record
• CVE-2026-106585 record