RHSA-2026:12389 Red Hat Security Advisory: openssh security update
Details
CVSS v3
7.5
NVD published
2026-04-02 17:16:27
EPSS
<0.1% probability · 11.5th percentile — 2026-05-01
Affected versions
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Summary
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
TopVuln sends digest emails with high-risk CVE picks across multiple authoritative sources—curated with EPSS and AI. Choose daily per-stream emails and optional weekly or monthly roundups.