Warning: OpenSSH Root Access Vulnerability (CVE-2026-35414), Patch Immediately!

OpenSSH versions before 10.3 contain an authentication-bypass vulnerability in the handling of the authorized_keys "principals" option when using user-trusted CA keys with certain comma usage, potentially granting attackers root privileges (CVSS 8.1). The issue has been present across many releases over the past 15 years, may not leave logs making detection difficult, and—while no active exploitation is reported—organisations are strongly advised to update to OpenSSH 10.3 or later and increase host-based monitoring and file integrity checks.