- OpenSSH 10.6 was released on 6 October 2026 and fixes eleven security-relevant bugs. The Debian Security Tracker lists ten CVE numbers for it, from CVE-2026-106552 to CVE-2026-106589.
- For Debian 12 and Debian 13, all ten are currently marked “vulnerable”, and there is no fixed package there yet. So far only Debian unstable is fixed.
- None of the ten descriptions mentions remote code execution before login. Three settings in
sshd_configremove the basis for the server-side vulnerabilities until the update arrives.
On almost every Linux server, SSH is the only way in. When the OpenSSH project publishes a version with a whole block of security fixes and your own distribution doesn't have a package yet, a practical question comes up: what can you do today, and what do you have to wait for?
What this is about
The release notes for OpenSSH 10.6 list eleven items under “Security”. The project writes that it has recently received a very large number of bug reports, many of them found with the help of AI tools. Because the same bugs are often discovered independently a second time shortly afterwards, the team plans to release smaller versions more often for now, instead of collecting fixes until the next major release. For operators, that means you should expect further security releases at short intervals.
We checked the state of the packages on 7 October 2026 in the Debian Security Tracker. Ten CVEs are listed there, all of them marked “vulnerable” for bookworm (Debian 12) and trixie (Debian 13).
| Component | Bug | Who is affected |
|---|---|---|
| sshd | Credentials from a failed GSSAPI attempt are retained and are available after a different, successful login (CVE-2026-106553, CVE-2026-106555) | Servers with GSSAPIAuthentication yes, so usually those with Kerberos |
| sshd and ssh | Side channel via shared compression: anyone who can inject their own data into a session can guess secrets from another channel of the same session by looking at the length of the encrypted packets (CVE-2026-106582) | Connections with compression enabled that mix trusted and untrusted data |
| sshd | The restrict keyword in authorized_keys did not apply to tunnel forwarding (CVE-2026-106586) | Servers with PermitTunnel other than no |
| sshd | In Match blocks, the value “none” was read as a file name for some options such as AuthorizedPrincipalsFile (CVE-2026-106587) | Servers with such Match rules |
| sshd and ssh | Compressed packets were not limited to the maximum packet size (CVE-2026-106585) | Connections with compression |
| sftp | A malicious server can write files outside the target folder during recursive copying (CVE-2026-106552) | You, as the client, when you fetch from a foreign server |
| ssh | $ and \ in the user name on the command line could reach the shell via ProxyCommand or Match exec (CVE-2026-106583) | Scripts that pass user names from foreign sources to ssh |
| ssh-keygen | Daylight saving time converted incorrectly, so certificates expired up to an hour earlier or later (CVE-2026-106584) | Anyone who issues SSH certificates |
The tenth CVE (CVE-2026-106589) concerns platforms such as QNX 6, where the session process keeps running with root privileges. It doesn't matter for Linux servers.
What we checked
What matters is whether the preconditions are met at all on a normally set-up server. To find out, we looked up the default values in the manual pages and read out the settings on an unmodified Ubuntu 24.04 with OpenSSH 9.6:
GSSAPIAuthenticationisnoby default on the server. If you don't use Kerberos, the two GSSAPI bugs don't affect you.PermitTunnelisnoby default. Therestrictbug only applies once you have deliberately allowed tunnels.Compressionisyesby default on the server andnoon the client. So compression only happens when the client requests it, for example withssh -C. When it does, though, the side channel applies in principle.
The result: for a server with default settings, what mainly remains is compression and the client-side bugs. Both can be defused without a new package.
sshd_config or use a template that does, the only thing that counts is what sshd -T prints on your server.How to check your server
- Determine the version.
Everything below 10.6 is affected, unless your distribution has backported the fixes. For Debian, the Security Tracker shows from which package version that is the case.ssh -V apt policy openssh-server - Read out the effective settings.
sudo sshd -T | grep -Ei '^(gssapiauthentication|compression|permittunnel) ' - Harden until the update. Add this to
/etc/ssh/sshd_configor to a separate file under/etc/ssh/sshd_config.d/:
Leave outCompression no GSSAPIAuthentication no PermitTunnel noGSSAPIAuthenticationandPermitTunnelonly if you actually use Kerberos or SSH tunnels. - Test the configuration, then reload.
Keep the current session open and log in again in a second window before you close the first one.sudo sshd -t && sudo systemctl reload ssh - Install the update as soon as it is available.
sudo apt update sudo apt install --only-upgrade openssh-server openssh-client
How to tell it worked
After the reload, sshd -T must show the new values, and logging in from the second window must work. After the package update, apt policy openssh-server shows the installed version. Compare it with the one listed as “fixed” in the Security Tracker.
tar czf or zstd. The OpenSSH project recommends this too, and it is immune to this side channel.And on your own machine?
Three of the bugs affect the client. Until your operating system delivers an update, it helps to use sftp -r and scp -r only against servers you trust, and not to pass user names from foreign input to ssh in scripts. By the way, from 10.6 on, scp -R prints a warning: the project wants to remove the option.
How to secure SSH access beyond this, with keys instead of passwords and with fail2ban, is covered in our post Securing SSH access properly. If the update fails on an old system, the post on upgrading from Debian 12 to Debian 13 will help.
