VulnSocial

CVE-2026-56624Disclosure(apache / mina_sshd)

LOWCVSS 7.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache mina_sshd systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*[email protected] user certificates (which are the only ones for which verify-required would make sense).

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-295

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mina_sshd

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-20); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
apache
Products
mina_sshd

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-20: 3Mentions · 2026-07-22: 1Patch / Workaround · 2026-07-20: 1Patch / Workaround · 2026-07-22: 1Technical Details · 2026-07-20: 3Technical Details · 2026-07-22: 107-2007-22
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-203
Disclosure2Patch1
2026-07-221
Patch1
Full discourse4 posts
  • Open Source Security mailing list@oss_security
    Patch

    Apache MINA SSHD: 4 CVEs fixed https://www.openwall.com/lists/oss-security/2026/07/20/ 3 are "Severity: moderate": CVE-2026-56452: Path traversal in SCP file reception CVE-2026-56623: Path traversal in org.apache.sshd:sshd-git on Windows CVE-2026-56624: SSH certificate options lack validations 1 more is "low"

    Post summary

    The message announces that four CVEs in Apache MINA SSHD have been fixed, detailing their severity and types, but provides no exploit or PoC information.

    00091966
    4.7K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-56624 Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH use… https://www.cve.org/CVERecord?id=CVE-2026-56624 ----- Traducción: CVE-2026-56624 Valida… http://infoflow.cloud`

    Post summary

    The content announces CVE‑2026‑56624, outlining an improper certificate validation flaw in Apache MINA SSHD with no PoC, exploit, or patch details.

    0000034
    93 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-56624 Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH use… https://www.cve.org/CVERecord?id=CVE-2026-56624

    Post summary

    The post announces the CVE-2026-56624 vulnerability in Apache MINA SSHD, detailing it as an improper certificate validation issue, but it does not provide PoC, exploit code, or evidence of active exploitation.

    00000721
    57.8K followersView on X
  • VulniPulse@vulnipulse
    Patch

    ⚠️ Apache MINA SSHD alert: CVE-2026-56624 (CVSS 7.3) Attackers could affect the listed product. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/apache-cve-2026-56624 #Apache #CyberSecurity #CVE

    Post summary

    The tweet announces Apache MINA SSHD CVE-2026-56624 with a CVSS score of 7.3 and recommends upgrading to a vendor‑fixed release. No proof of exploitation or exploit code is provided.

    0000033
    6 followersView on X
CPE platform detail5 entries

5 of 5 entries

PartVendorProductVersionTarget SWTarget HW
Appapachemina_sshd---
Appapachemina_sshd3.0.0--
Appapachemina_sshd3.0.0--
Appapachemina_sshd3.0.0--
Appapachemina_sshd3.0.0--

Explore more

Back to dashboardapache CVEsmina_sshd vulnerabilities