Posted by Thomas Wolf on Sep 29 Severity: critical CVSS 3.1: 9.1 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected versions: - Apache MINA SSHD (org.apache.sshd:sshd-core) 2.0.0 before 2.20.0 - Apache MINA SSHD (org.apache.sshd:sshd-core) 3.0.0-M1 before 3.0.0-M6 Description: Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA...
CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/1005
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
Posted by Hussein Awala on Oct 26 Severity: low Affected versions: - Apache Airflow SSH provider 4.3.0 before 7.0.1 Description: In apache-airflow-providers-ssh before…
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow SFTP provider before 7.0.0 Description: The Apache Airflow SFTP provider's…
CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow SSH provider before 7.0.0 - Apache Airflow SFTP provider before 7.0.0…
OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing
The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have…
Announce: OpenSSH 10.6 released
Posted by Damien Miller on Oct 06 OpenSSH 10.6 has just been released. It will be available from the mirrors listed at https://www.openssh.com/ shortly. OpenSSH is a…
CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap
Posted by Thomas Wolf on Sep 29 Severity: critical CVSS 3.1: 9.1 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected versions: - Apache MINA SSHD 1.2.0…