CVE-2026-60002 is a high severity (CVSS 7.7) use-after-free in the OpenSSH ssh client before 10.4. It can occur when a server changes its host key during a key re-exchange, and only on the client side. OpenSSH 10.4 fixes it, and newer releases are available.
What's affected
- OpenSSH
ssh(client) before 10.4. Fixed in OpenSSH 10.4 / 10.4p1. - The record says the outcome occurs only on the client side. The
sshdserver is not the place this bug fires. - Weakness: CWE-416, use after free. CVSS 7.7 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
The OpenSSH 10.4 release notes list it as a possible client side use-after-free if the server changes its host key during a key re-exchange.
How to check if you're exposed
Print the client version on each machine that runs ssh.
ssh -V
Anything older than 10.4 is in range. Distributions often backport fixes without changing the version string, so also check your vendor's security notice for the package, for example:
# Debian and Ubuntu
apt list --installed 2>/dev/null | grep openssh-client
# Red Hat family
rpm -q openssh-clients
Include jump hosts, CI runners, build images and developer laptops. Anything that runs ssh as a client counts.
What to do now
- Run
ssh -Von laptops, jump hosts, CI runners and container images. - Update the OpenSSH client packages to 10.4 or later, or to your distribution's patched package.
- The release notes site shows OpenSSH 10.6 released on 6 October 2026. Prefer the newest release your vendor ships.
- Until updated, connect only to servers you trust, since the trigger is a server that misbehaves.
Why it matters
A use-after-free means code keeps using memory after it has been released. Memory safety bugs like this can crash a program, and in the worst case let an attacker steer it. The trigger here is unusual. It needs a server that changes its host key partway through a session.
That is why the attack complexity is marked high and why only the client is involved. Clients that connect to servers you do not control are the main concern. The record's KEV flag is false, and the release notes do not describe exploitation.
Quick check
Is sshd affected?
The record says the use-after-free occurs only on the client side.
Where is the fix described?
In the OpenSSH 10.4 release notes, listed as a client side use-after-free if the server changes its host key during a key reexchange.
Sources
- OpenSSH release notes
- oss-security post (listed in the record)
Last reviewed: 19 October 2026.
