CVE-2026-110923 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for OpenSSH installations, especially those using sftp with potentially untrusted servers, should assess their exposure and take necessary actions.

Why it matters

CVE-2026-110923 is a medium-severity vulnerability in OpenSSH's sftp client. Defenders should verify and update OpenSSH installations, review sftp usage, and monitor for suspicious activity. The vulnerability allows a malicious server to write outside the user's selected destination directory during sftp operations.

• Potential unauthorized data writes
• Need for verification of OpenSSH versions and configurations
• Possible data integrity issues

Technical summary

The OpenSSH sftp client does not properly sanitize server-supplied paths, allowing a malicious server to write outside the intended destination directory. This can occur when the server provides an empty name, a path containing only a slash, or a '..' basename. The vulnerability is caused by a lack of proper input validation and sanitization in the sftp client. Defenders should prioritize verifying and updating OpenSSH installations, especially in environments where sftp is used with untrusted servers, and review sftp usage to restrict access to trusted servers.

Defensive priority

Defenders should prioritize verifying and updating OpenSSH installations, especially in environments where sftp is used with untrusted servers.

Recommended defensive actions

• Verify OpenSSH installations and ensure they are up-to-date with the latest security patches.
• Review sftp usage and restrict access to trusted servers only.
• Monitor for suspicious sftp activity and implement additional logging and monitoring measures.
• Perform a thorough review of OpenSSH configurations and ensure that sftp is properly configured.
• Implement compensating controls, such as network segmentation or access controls, to limit the impact of the vulnerability.
• Conduct a thorough asset inventory to identify potentially affected systems and prioritize remediation efforts.
• Track exceptions and retest remediated assets to ensure that the vulnerability has been properly mitigated.

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Red Hat offers advisories and errata related to this issue. The vulnerability has been reported in OpenSSH's sftp client, and defenders should verify and update OpenSSH installations, especially in environments where sftp is used with untrusted servers. The evidence is based on official CVE and NVD records, as well as Red Hat advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.