CVE-2026-35385

Name
CVE-2026-35385
Description
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2
cve@mitre.org https://www.openssh.org/releasenotes.html#10.3p1
cve@mitre.org https://www.openwall.com/lists/oss-security/2026/04/02/3
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:12389
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:13380
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:13381
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:13383
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:14937
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:16059
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:19069
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:19219
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:20040
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:21275
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:21298
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:21398
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:22329
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:22468
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:22564
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:22648
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25044
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25063
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25096
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25181
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:26528
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:26542
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:30078
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:30087
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:30088
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:30089
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/security/cve/CVE-2026-35385
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://bugzilla.redhat.com/show_bug.cgi?id=2454469
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:28887
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:28962
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:34098
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:58981

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* openssh >= None < 10.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openssh edge-main 10.3_p1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh edge-main 10.2_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.1_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r11 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r10 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r6 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 10.0_p1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 9.9_p2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 9.9_p1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 9.8_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 9.6_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 8.9_p2-r0 None possibly vulnerable
openssh edge-main 8.8_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 8.5_p1-r0 None possibly vulnerable
openssh edge-main 8.4_p1-r0 None possibly vulnerable
openssh edge-main 7.9_p1-r3 None possibly vulnerable
openssh edge-main 7.7_p1-r4 None possibly vulnerable
openssh edge-main 7.5_p1-r8 None possibly vulnerable
openssh edge-main 7.4_p1-r0 None possibly vulnerable
openssh 3.23-main 10.2_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.22-main 10.0_p1-r10 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.22-main 10.0_p1-r9 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.22-main 10.0_p1-r8 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.22-main 10.0_p1-r7 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.22-main 9.9_p2-r0 None possibly vulnerable
openssh 3.22-main 9.8_p1-r0 None possibly vulnerable
openssh 3.22-main 9.6_p1-r0 None possibly vulnerable
openssh 3.22-main 8.8_p1-r0 None possibly vulnerable
openssh 3.22-main 8.5_p1-r0 None possibly vulnerable
openssh 3.22-main 8.4_p1-r0 None possibly vulnerable
openssh 3.22-main 7.9_p1-r3 None possibly vulnerable
openssh 3.22-main 7.7_p1-r4 None possibly vulnerable
openssh 3.22-main 7.5_p1-r8 None possibly vulnerable
openssh 3.22-main 7.4_p1-r0 None possibly vulnerable
openssh 3.21-main 9.9_p2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.21-main 9.9_p1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.21-main 9.8_p1-r0 None possibly vulnerable
openssh 3.21-main 9.6_p1-r0 None possibly vulnerable
openssh 3.21-main 8.8_p1-r0 None possibly vulnerable
openssh 3.21-main 8.5_p1-r0 None possibly vulnerable
openssh 3.21-main 8.4_p1-r0 None possibly vulnerable
openssh 3.21-main 7.9_p1-r3 None possibly vulnerable
openssh 3.21-main 7.7_p1-r4 None possibly vulnerable
openssh 3.21-main 7.5_p1-r8 None possibly vulnerable
openssh 3.21-main 7.4_p1-r0 None possibly vulnerable
openssh 3.20-main 9.7_p1-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.20-main 9.7_p1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.20-main 9.6_p1-r0 None possibly vulnerable
openssh 3.20-main 8.8_p1-r0 None possibly vulnerable
openssh 3.20-main 8.5_p1-r0 None possibly vulnerable
openssh 3.20-main 8.4_p1-r0 None possibly vulnerable
openssh 3.20-main 7.9_p1-r3 None possibly vulnerable
openssh 3.20-main 7.7_p1-r4 None possibly vulnerable
openssh 3.20-main 7.5_p1-r8 None possibly vulnerable
openssh 3.20-main 7.4_p1-r0 None possibly vulnerable
openssh 3.19-main 9.7_p2-r5 None possibly vulnerable
openssh 3.19-main 9.6_p1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.19-main 9.6_p1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.19-main 9.6_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.19-main 8.8_p1-r0 None possibly vulnerable
openssh 3.19-main 8.5_p1-r0 None possibly vulnerable
openssh 3.19-main 8.4_p1-r0 None possibly vulnerable
openssh 3.19-main 7.9_p1-r3 None possibly vulnerable
openssh 3.19-main 7.7_p1-r4 None possibly vulnerable
openssh 3.19-main 7.5_p1-r8 None possibly vulnerable
openssh 3.19-main 7.4_p1-r0 None possibly vulnerable
dropbear edge-main 2026.91-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
dropbear 3.24-main 2026.91-r0 Natanael Copa <ncopa@alpinelinux.org> fixed