---
title: CVE-2026-35414
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-35414
---

# CVE-2026-35414

Publication date 2 April 2026

Last updated 22 September 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**4.2 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-35414#impact-score)

Toggle side navigation

## Description

OpenSSH before 10.3 mishandles the authorized\_keys principals option in
uncommon scenarios involving a principals list in conjunction with a
Certificate Authority that makes certain use of comma characters.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2026-35414#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| openssh | 26.04 LTS resolute | Fixed 1:10.2p1-2ubuntu3.2 |
| 25.10 questing | Fixed 1:10.0p1-5ubuntu5.4 |
| 24.04 LTS noble | Fixed 1:9.6p1-3ubuntu13.16 |
| 22.04 LTS jammy | Fixed 1:8.9p1-3ubuntu0.15 |
| 20.04 LTS focal | Fixed 1:8.2p1-4ubuntu0.13+esm3  Ubuntu Pro |
| 18.04 LTS bionic | Fixed 1:7.6p1-4ubuntu0.7+esm6  Ubuntu Pro |
| 16.04 LTS xenial | Fixed 1:7.2p2-4ubuntu2.10+esm9  Ubuntu Pro |
| 14.04 LTS trusty | Fixed 1:6.6p1-2ubuntu2.13+esm4  Ubuntu Pro |
| openssh-ssh1 | 26.04 LTS resolute | Ignored |
| 25.10 questing | Ignored |
| 24.04 LTS noble | Ignored |
| 22.04 LTS jammy | Ignored |
| 20.04 LTS focal | Ignored |
| 18.04 LTS bionic | Ignored |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2026-35414#patch-details)

### Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

[Get Ubuntu Pro](https://ubuntu.com/pro)
[30-day free trial](https://ubuntu.com/pro/free-trial)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

openssh-ssh1 is only provided for compatibility with old devices
that cannot be upgraded to modern protocols. We will not be
providing any security support for the openssh-ssh1 package as
it is insecure and should be used in trusted environments only.
Ths fix for this was included in the commit below, which is the
same commit as CVE-2026-35387. See:
https://marc.info/?l=openssh-unix-dev&m=177577578010618&w=2

---

### [leosilva](https://launchpad.net/~leosilva)

This issue affects xenial only partially.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| openssh | * Upstream:   [fd1c7e1](https://github.com/openssh/openssh-portable/commit/fd1c7e131f331942d20f42f31e79912d570081fa) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

4.2 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | High |
  | Privileges required | Low |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | Low |
  | Integrity impact | Low |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 4.2 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35414)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-35414)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-35414)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-35414)

### Related Ubuntu Security Notices (USN)

+ [USN-8222-1](https://usn.ubuntu.com/USN-8222-1)
+ OpenSSH vulnerabilities
+ 29 April 2026

+ [USN-8577-1](https://usn.ubuntu.com/USN-8577-1)
+ OpenSSH vulnerability
+ 21 July 2026

+ [USN-8804-1](https://usn.ubuntu.com/USN-8804-1)
+ OpenSSH vulnerabilities
+ 22 September 2026

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-35414>
* <https://www.openssh.org/releasenotes.html#10.3p1>