TLDR Tech / InfoSec
OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years
CVE-2026-35414 affects OpenSSH versions from the past 15 years. A code reuse error allows commas in SSH certificate principals to be parsed as list separators. If a certificate contains "deploy,root" as a principal, OpenSSH splits on the comma and grants root access. The attack leaves no authentication failure in logs and researchers created a working exploit in twenty minutes. OpenSSH 10.3 patches the flaw.
Read the full story