CVE-2026-106588
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss...
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- Record
CVE-2026-106588- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-653
- Updated
- 2026-11-02
EUVDEUVD-2026-94050
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- Record
EUVD-2026-94050- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-74g8-x9g6-gwmc
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss...
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- Record
GHSA-74g8-x9g6-gwmc- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-653
- Updated
- 2026-11-02
NVD
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- Record
CVE-2026-106588- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-653
- Updated
- 2026-11-02
OSVBELL-CVE-2026-106588
CVE-2026-106588 does not affect BellSoft software
- Record
BELL-CVE-2026-106588- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-106588
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- Record
UBUNTU-CVE-2026-106588- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVAZL-110501 No score
CVE-2026-106588 affecting package openssh 9.8p1-10
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- Record
AZL-110501- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensshAzure Linux:3 |
through 9.8p1-10 | None known |
openssh-ssh1Ubuntu:18.04:LTS |
All versions, plus listed versions 1:7.5p1-81:7.5p1-91:7.5p1-9build11:7.5p1-10 |
None known |
openssh-ssh1Ubuntu:20.04:LTS |
All versions, plus listed versions 1:7.5p1-11build1 |
None known |
openssh-ssh1Ubuntu:22.04:LTS |
All versions, plus listed versions 1:7.5p1-121:7.5p1-12build11:7.5p1-13 |
None known |
openssh-ssh1Ubuntu:24.04:LTS |
All versions, plus listed versions 1:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-16 |
None known |
openssh-ssh1Ubuntu:26.10 |
All versions, plus listed versions 1:7.5p1-181:7.5p1-18ubuntu11:7.5p1-18ubuntu2 |
None known |
openssh-ssh1Ubuntu:26.04:LTS |
All versions, plus listed versions 1:7.5p1-171:7.5p1-18 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-106588 is a low vulnerability (CVSS 3.1) in Openbsd Openssh, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.