CVE-2026-106583 is a low severity flaw (CVSS 2.5) in the OpenSSH ssh client. Before 10.6, a dollar sign or backslash could appear in a command line username and lead to injection. OpenSSH 10.6, released on 6 October 2026, refuses such usernames, so upgrade to 10.6 or later.
What's affected
The record says ssh in OpenSSH before 10.6 is affected. The OpenSSH 10.6 release notes describe the matching change in the section on potentially incompatible changes: destination usernames entered on the command line are now more strictly checked, and the client will refuse usernames that include backslash and dollar symbols. Usernames given by the User directive in configuration files are not subject to the new check.
The weakness is CWE-99, improper control of resource identifiers, also known as resource injection. The vector is local, with high attack complexity and low privileges, and only a low integrity impact. The score is 2.5.
This is the client, not the server. The risk sits in scripts and tools that build an ssh command from untrusted input, such as a username taken from a ticket, a form or a file. The ssh program itself is not the weak point so much as the way a username is passed along and expanded later.
Because the notes call the stricter check potentially incompatible, test your automation after upgrading.
How to check if you're exposed
Read the client version:
ssh -V
Then look at how your own code calls ssh. Search scripts, CI jobs and deployment tools for places where the username comes from a variable you do not fully control:
grep -rn "ssh " scripts/ .github/ ci/ 2>/dev/null | grep -E '\$\{?[A-Za-z_]+\}?@'
The pattern finds user@host constructions with a variable in front of the at sign. Review each match and check that the value is validated against a strict pattern, for example letters, digits, dots, dashes and underscores only.
Also check any tool that wraps ssh, such as Ansible, rsync over ssh, or git remotes, and see which ssh client binary it calls.
What to do now
- Upgrade OpenSSH clients to 10.6 or later, including the clients inside build images and containers.
- Validate any username you pass to ssh against a strict allowlist of characters before building the command.
- Prefer passing the user with the User option or configuration entry, which the notes say is not subject to the new restriction, but still validate the value.
- Test automation after the upgrade, because refusing a previously accepted username can break a job.
- Do not build shell command strings by concatenation. Pass arguments as a list wherever your language allows it.
Why it matters
Injection bugs come from the same mistake: data is treated as syntax. A dollar sign starts a variable in many shells and a backslash escapes the next character, so a username containing them can change what a later command means. According to the record, ssh could receive such a username on the command line and the result was injection.
The score is low because the attacker must influence a username that someone passes on the command line, which needs local conditions and some privilege. For most users that is rare. For a script that takes usernames from outside, the shape of the risk is familiar and the defence is the one you would apply to any user input: validate it, and do not pass it through a shell.
The fix in OpenSSH is to refuse the characters outright. That is a sound design because a username that contains them is almost never intended. The record does not flag this CVE as known exploited.
Quick check
Will the stricter check break my scripts?
Only if they pass usernames containing a backslash or a dollar sign on the command line. The release notes list the change as potentially incompatible, so test.
Does it affect usernames set in ssh_config?
The release notes say usernames from the User directive in configuration files are not subject to the restriction.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
