CVE-2026-59846

What it actually does

The flaw is a command injection issue in libssh ProxyCommand handling. When a username is expanded into a ProxyCommand via the %r token, shell metacharacters in that username can be interpreted by the local shell rather than treated as data. If an attacker can control or influence the username used by a libssh-based client or application, and a user or process initiates a connection that uses ProxyCommand with %r, the attacker may cause unintended local shell behavior, including limited command execution and exposure of environment variables. The CVSS vector indicates local attack requirements, low complexity, low privileges, and required user interaction, with limited confidentiality and integrity impact and no expected availability impact.

Why it matters to the business

Organizations using affected libssh builds may be exposed to abuse in workflows where SSH destinations or usernames are influenced by users, automation inputs, repositories, configuration files, or external systems. Successful exploitation could leak environment variables such as tokens, proxy settings, credentials, or build secrets available to the invoking process, and could alter local command behavior. The risk is moderated by the need for a vulnerable ProxyCommand configuration and user or application interaction, and the low EPSS score and absence from the CISA KEV catalog indicate no known broad exploitation at this time. However, because libssh can be embedded in downstream tools and automation, exposure may be indirect and difficult to inventory.

How an attack unfolds

An attacker first identifies an application, script, or workflow that uses libssh and enables ProxyCommand with the %r placeholder for the remote username. The attacker then supplies a crafted username containing shell metacharacters such as command separators, command substitution, pipes, or redirection. When the victim user or automated process initiates the SSH connection, libssh expands %r into the ProxyCommand. If the expanded value is passed to a shell without safe quoting or argument separation, the shell interprets the attacker's metacharacters as syntax. The injected shell fragments may run local commands in the context of the invoking user or process, read environment variables, redirect output, or contact attacker-controlled infrastructure. Exploitation is most plausible in developer, CI/CD, administrative, or automation scenarios where untrusted connection parameters are accepted and ProxyCommand is in use.

How to fix it

Upgrade affected Red Hat libssh-main packages to a fixed release. The provided fixed version is libssh-main 0.12.1-4.hum1 via RHSA-2026:42922. Where immediate upgrade is not possible, avoid using %r in ProxyCommand templates when the username can be influenced by untrusted input, remove or disable ProxyCommand for untrusted destinations, strictly validate usernames to a conservative allowlist such as alphanumeric characters plus limited safe separators, and avoid invoking shell-based proxy commands with unsanitized values. Review embedded or statically linked libssh copies in downstream applications and rebuild or update those applications against a fixed libssh version.

How to confirm the fix worked

Confirm installed libssh package versions are at or above the fixed release identified by the vendor advisory. Review SSH and application configuration for ProxyCommand entries that contain %r, especially in templates, generated configuration, CI/CD jobs, developer tooling, and automation. Test representative workflows with benign metacharacter-containing usernames in a controlled environment to ensure the value is rejected, escaped, or passed as data rather than executed by a shell. Validate that downstream applications using libssh have been rebuilt or updated against a fixed library. Package validation should include vendor package metadata, software composition analysis, container image scans, and runtime checks for loaded libssh library versions.

Typical attack path

1. Find or influence a libssh-based client, tool, script, or automation path that uses ProxyCommand.
2. Confirm that the ProxyCommand template expands the remote username with %r.
3. Provide a malicious username containing shell metacharacters such as ;, &&, |, backticks, or $().
4. Wait for a user or automated process to initiate the SSH connection using the attacker-controlled username.
5. Trigger expansion of %r inside ProxyCommand, causing the local shell to interpret injected syntax.
6. Execute unintended commands or expose environment variables available to the libssh process.

How to detect it

To determine whether this was already exploited, focus on endpoints, build systems, developer workstations, servers, and containers that run libssh-based clients or automation. Review EDR, process accounting, auditd, shell history, and command-line telemetry for shell processes spawned by SSH-related tools or applications immediately after connection attempts. Look for /bin/sh, bash, dash, curl, wget, nc, env, printenv, or similar utilities launched from a libssh-using parent process. Review application logs, SSH wrapper logs, CI/CD job logs, terminal recordings, and configuration-generation logs for usernames containing shell metacharacters or command substitution syntax. Search configuration files and generated SSH configs for ProxyCommand entries containing %r. Investigate any connection attempt where the remote username includes ;, &&, ||, |, backticks, $(), redirection, newline characters, or environment-variable expansion. Also review outbound network telemetry for unexpected connections from processes that normally only initiate SSH or proxy helper connections.

• ProxyCommand.*%r
• /bin/sh -c
• /bin/bash -c
• /bin/dash -c
• username=.*;
• username=.*&&
• username=.*||
• username=.*|
• username=.*`
• username=.*$(
• username=.*>
• username=.*<
• username=.*${
• printenv
• env |
• curl http
• curl https
• wget http
• wget https
• nc -e
• /dev/tcp/
• SSH_ORIGINAL_COMMAND
• ProxyCommand

What your security team should do

• Prioritize patching systems, containers, and applications that use libssh with ProxyCommand or that accept externally supplied SSH usernames.
• Upgrade Red Hat libssh-main to 0.12.1-4.hum1 or later as provided by RHSA-2026:42922.
• Inventory applications and automation that embed or dynamically link libssh, including CI/CD tooling, administrative utilities, network tools, and custom SSH integrations.
• Search configurations for ProxyCommand entries using %r and remove, replace, or harden them where user input is not fully trusted.
• Add input validation for SSH usernames in applications that pass connection parameters to libssh.
• Hunt for suspicious shell execution spawned from libssh-based applications, especially commands that enumerate or exfiltrate environment variables.
• Monitor vendor advisories because this issue was published recently and exploitation maturity may change.