CVE-2026-106586
Description
A flaw was found in OpenSSH. In configurations where tunnel forwarding is enabled on the server, the restrict option in the authorized keys configuration fails to properly block tunnel forwarding requests. An authenticated user connecting with a restricted key can exploit this issue to bypass intended access limitations and establish unauthorized network tunnels through the server.
Statement
A low severity security restriction bypass affects the openssh component in Red Hat Hardened Images (hummingbird-1). In OpenSSH sshd, the authorized_keys "restrict" keyword is intended to disable all forwarding features for a key, but it was not being applied to tunnel forwarding. On servers where tunnel forwarding has been enabled (the PermitTunnel option is disabled by default), an authenticated user connecting with a key restricted via "restrict" could bypass the intended access limitation and establish unauthorized network tunnels through the server. The impact is limited to integrity; the flaw does not directly affect confidentiality or availability. Red Hat Hardened Images is affected, and a fix is being pursued through the delegated hummingbird-1 update stream. Red Hat rates this flaw low severity (CVSS 3.1 score 2.5) because exploitation requires an authenticated user with an assigned restricted key and a non-default server configuration that enables tunnel forwarding; NIST has rated it moderate (CVSS 3.1 score 4.3).
Mitigation
This flaw only affects servers where tunnel forwarding has been explicitly enabled; PermitTunnel is disabled by default in OpenSSH sshd. As a workaround, tunnel forwarding can be disabled by setting "PermitTunnel no" in /etc/ssh/sshd_config (or removing any configuration that enables it) and restarting the sshd service, which prevents restricted keys from establishing network tunnels. This flaw can also be resolved by updating to the corrected openssh packages available through the affected Red Hat Hardened Images update stream.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 2.5 | 4.3 | 2.5 |
| Attack Vector | Local | Network | Local |
| Attack Complexity | High | Low | High |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | Low | Low | Low |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
