PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56623 Apache Software Foundation CVE debrief

A path traversal vulnerability exists in Apache MINA SSHD component sshd-git on Windows, allowing authenticated remote users to access git repositories outside the configured server-side root directory. This issue arises from incomplete path validation for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 on Windows. Affected applications use org.apache.sshd:sshd-git to implement git servers on Windows. Users should upgrade to Apache MINA SSHD 2.19.0 or 3.0.0-M5. The vulnerability has a CVSS score of 7.1 and is considered High severity.

Vendor
Apache Software Foundation
Product
Apache MINA SSHD
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-27
Advisory published
2026-07-20
Advisory updated
2026-07-27

Who should care

Developers and administrators using Apache MINA SSHD component sshd-git on Windows to implement git servers should be aware of this vulnerability. They need to assess if their applications are affected and upgrade to a fixed version to prevent unauthorized access to git repositories. This includes reviewing system inventory, understanding deployment configurations, and coordinating with relevant security teams.

Technical summary

The CVE-2026-56623 vulnerability is caused by inadequate path validation in Apache MINA SSHD component sshd-git on Windows. Specifically, the fix for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was incomplete for Windows environments. This allows authenticated remote users to bypass restrictions and access git repositories outside the intended server-side root directory. The issue is resolved in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Affected applications are those using org.apache.sshd:sshd-git on Windows.

Defensive priority

High

Recommended defensive actions

  • Upgrade to Apache MINA SSHD 2.19.0 or 3.0.0-M5
  • Review and adjust path validation mechanisms
  • Monitor for suspicious git repository access
  • Implement compensating controls for git server security
  • Review affected system inventory for Apache MINA SSHD component sshd-git on Windows
  • Plan and schedule updates through normal change control for exposed systems
  • Track exceptions and retest remediated assets for CVE-2026-56623

Evidence notes

The CVE record was published on 2026-07-20T21:16:48.947Z and was last modified on 2026-07-27T13:50:42.327Z. The NVD entry is currently Analyzed. This issue is caused by partly ineffective path validation for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 on Windows. Developers should verify if their applications use org.apache.sshd:sshd-git and run on Windows. Evidence is limited to public CVE and NVD information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56623 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56623

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56623 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56623

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.