CVE-2026-35385
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 2, 2026
- Updated
- Sep 1, 2026
- Reserved
- Apr 2, 2026
Description
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | mitre |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | redhat-SADP |
Weaknesses
- CWE-281 Improper Preservation of Permissions
Affected Products
| Product | Versions |
|---|---|
OpenSSHOpenBSD |
|
References
- https://www.openssh.org/releasenotes.html#10.3p1
- https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2
- https://www.openwall.com/lists/oss-security/2026/04/02/3
- https://access.redhat.com/security/cve/CVE-2026-35385vdb-entry
- RHBZ#2454469issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35385.json
- https://access.redhat.com/errata/RHSA-2026:25063vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22468vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26528vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26542vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:28887vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:28962vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:25044vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:34098vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:25181vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:20040vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:12389vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:13380vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19069vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:13383vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:21398vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22648vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22564vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:16059vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:13381vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:19219vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:22329vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:21298vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:25096vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:30078vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:30089vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:30088vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:30087vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:14937vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:21275vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:58981vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.