CVE-2026-59846

—

CVSS 3.1

3.9 low

EPSS

<1%p2

Published

Jul 21, 2026 (Jul 21, 2026)

Modified

Sep 1, 2026

Description

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

Vendors: libssh redhat
Products: libssh, hardened images, enterprise linux
Weakness: CWE-78, CWE-77
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.