CVE-2026-110925 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Hardened Images, Red Hat Enterprise Linux, and Red Hat OpenShift Container Platform should assess exposure and verify OpenSSH configurations. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the potential impact on their systems and prioritize verification of OpenSSH configurations.

Why it matters

This vulnerability in OpenSSH could allow an attacker to pass malicious input to the shell, potentially leading to security consequences. Defenders should prioritize verifying the presence of this vulnerability in their OpenSSH configurations and assess the potential impact on their systems.

• Verify OpenSSH configurations for potential vulnerability
• Assess the impact on Red Hat products
• Review vendor advisories for remediation guidance
• Monitor for potential exploitation attempts

Technical summary

The vulnerability occurs in OpenSSH when a username entered on the ssh command line contains '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell. This issue affects multiple Red Hat products, including Red Hat Hardened Images, Red Hat Enterprise Linux, and Red Hat OpenShift Container Platform. The vulnerability could allow an attacker to pass malicious input to the shell, potentially leading to security consequences. Defenders should prioritize verifying the presence of this vulnerability in their OpenSSH configurations and assess the potential impact on their systems.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their OpenSSH configurations and assess the potential impact on their systems.

Recommended defensive actions

• Verify OpenSSH configurations for potential vulnerability
• Assess the impact on Red Hat Hardened Images
• Review vendor advisories for remediation guidance
• Monitor for potential exploitation attempts
• Perform asset inventory of potentially affected systems
• Plan for vendor-supported updates or mitigations
• Review compensating controls for exposed systems

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenSSH, which allows a username entered on the ssh command line to contain '$' or a non-trailing backslash. These characters are passed into the shell when a configuration expands %u inside ProxyCommand or Match exec. The corpus does not establish versions, exploitation, impact, or remediation for all affected products. Defenders should verify OpenSSH configurations for potential vulnerability, assess the impact on Red Hat products such as Red Hat Hardened Images,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.