CVE-2026-56624 Details
Description
Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*[email protected] user certificates (which are the only ones for which verify-required would make sense).
A vulnerability exists in the server-side OpenSSH user certificate validation of Apache MINA SSHD versions 2.0.0 through 2.18.0 and 3.0.0-M1 through 3.0.0-M4. The issue arises because the validation process did not check for certain unsupported options, specifically force-command and verify-required, that could be embedded in the certificate. This oversight allowed users to authenticate with certificates containing a force-command option while still being able to execute other commands, depending on the server's implementation. The vulnerability stems from the lack of proper validation for these certificate options during user authentication.
Users are advised to upgrade to Apache MINA SSHD versions 2.19.0 or 3.0.0-M5, both of which address this vulnerability by rejecting OpenSSH user certificates that include the unsupported options. Instructions for upgrading can be found on the Apache MINA SSHD website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/20/17 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6 | [email protected] | Vendor AdvisoryMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache mina sshd | >= 2.0.0, < 2.19.0 3.0.0 m1 3.0.0 m2 3.0.0 m3 3.0.0 m4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | CVE Modified | CVE |
| Jul 20, 2026 | New CVE Received | [email protected] |