CVE-2026-35414

MEDIUM LAB

OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-35414. PoCs published by exploitintel, killercd.

AI-analyzed exploit summary This repository contains functional exploit code for CVE-2026-35414, an OpenSSH certificate principal matching bypass vulnerability. It includes two working PoC scripts demonstrating authentication bypass via comma injection and empty principals, along with a lab setup for testing.

Description

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Exploits (2)

github WORKING POC 3 stars
by exploitintel · cpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2026-35414

This repository contains functional exploit code for CVE-2026-35414, an OpenSSH certificate principal matching bypass vulnerability. It includes two working PoC scripts demonstrating authentication bypass via comma injection and empty principals, along with a lab setup for testing.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: OpenSSH < 10.3
No auth needed
Prerequisites: Docker for lab setup · Python 3 for PoC execution
devstral-2 · analyzed Apr 07, 2026 Full analysis →
github WRITEUP
by killercd · poc
https://github.com/killercd/CVE-2026-35414

The repository provides a technical analysis of CVE-2026-35414, comparing vulnerable and fixed code in `auth2-pubkeyfile.c`. The vulnerability involves improper handling of principal lists in SSH certificate authentication, likely leading to an authentication bypass.

Classification
Writeup 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: OpenSSH (version not specified)
No auth needed
Prerequisites: SSH certificate with crafted principals
devstral-2 · analyzed Apr 29, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 4.2
EPSS 0.0004
EPSS Percentile 11.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Lab Environment

EIP LAB
Docker Lab
patched docker pull ghcr.io/exploitintel/cve-2026-35414-patched:latest
vulnerable docker pull ghcr.io/exploitintel/cve-2026-35414-vulnerable:latest

Details

CWE
CWE-670
Status published
Products (2)
OpenBSD/OpenSSH < 10.3
openbsd/openssh < 10.3
Published Apr 02, 2026
Tracked Since Apr 02, 2026