CVE-2026-35414

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios that involve a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. This condition only applies to user-trusted CA keys in authorized_keys, the main certificate authentication path is not affected. It is worth noting that an attack will not leave traces in the logs. Since log-based detection is ineffective here, deploy host-based intrusion detection and file integrity monitoring to catch signs of compromise. OpenSSH has not reported any active exploitation of this vulnerability.