CVE-2026-59999: OpenSSH DisableForwarding Bypass Allows Unauthorized SSH Tunneling

Technical summary

CVE-2026-59999 is a precedence and configuration validation flaw in OpenSSH sshd. The vulnerability stems from improper handling of conflicting configuration directives: DisableForwarding=yes should globally disable all forwarding mechanisms including tunneling, but the implementation fails to enforce this precedence when PermitTunnel=yes is also set. This results in tunnel operations being permitted despite the intended global disable. The issue is rooted in CWE-348 (Misrepresentation of Functionality), where the actual behavior diverges from documented or intended security posture.

Business impact

Organizations relying on DisableForwarding as a mandatory security control to prevent unauthorized network access or data exfiltration via SSH tunneling are exposed to bypass. In restricted network environments where SSH access is granted but tunneling must be prohibited for compliance or security policy, this flaw creates an unintended attack surface. Attackers with valid SSH credentials could establish tunnel connections to circumvent network segmentation, potentially accessing internal resources that should remain isolated.

Affected systems

OpenSSH versions prior to 10.4 running on OpenBSD and other systems using the affected codebase. Organizations should inventory sshd installations and verify their version number. Patch availability and deployment timelines should be confirmed with the OpenBSD project and any downstream distributions or SSH implementations that incorporate the vulnerable code.

Exploitability

Exploitation requires valid SSH credentials and knowledge that the target system has both DisableForwarding and PermitTunnel directives enabled simultaneously—a configuration error or miscommunication between administrators. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects network-adjacent attack surface with high complexity, indicating that while remote access is required, specific conditions must align for the flaw to be exploitable. The integrity impact is high because unauthorized tunneling compromises intended network security controls.

Remediation

Upgrade OpenSSH to version 10.4 or later. Until patching is feasible, conduct immediate configuration audits to identify systems where DisableForwarding and PermitTunnel are both enabled; on affected versions, prioritize disabling PermitTunnel explicitly or removing DisableForwarding in favor of more granular SSH configuration alternatives. Apply the principle of least privilege by restricting SSH access and augmenting tunnel prevention with network-layer controls (firewall rules, network segmentation).

Patch guidance

Verify the availability of OpenSSH 10.4 or later from the OpenBSD project. Test the patch in a non-production environment to confirm that forwarding behavior aligns with your security policy. After patching, validate that configuration files still reflect intended DisableForwarding and PermitTunnel settings and that no tunneling is possible. Review downstream distributions (e.g., Linux vendors) for their own patch releases and timelines.

Detection guidance

Monitor sshd configuration files and process arguments for simultaneous presence of DisableForwarding=yes and PermitTunnel=yes. Review SSH session logs and network connections for unexpected tunnel activity (port forwarding, SOCKS proxies) originating from sshd processes, particularly on systems where DisableForwarding was intended to prevent such activity. Correlate SSH authentication logs with suspicious outbound connections or access to internal resources that should have been blocked by DisableForwarding.

Why prioritize this

While not yet listed in the CISA KEV catalog, this vulnerability affects a critical authentication and access control service (sshd) and has moderate-to-high integrity impact. Organizations that explicitly rely on DisableForwarding for security policy enforcement should prioritize patching, especially if SSH is exposed to untrusted networks. The high complexity requirement reduces immediate risk but does not eliminate it for misconfigured deployments.

Risk score, explained

The CVSS 5.9 MEDIUM score reflects network-remote attack vector, high configuration complexity (AC:H), no authentication requirement, and high integrity impact with no confidentiality or availability impact. The score appropriately captures a configuration logic flaw that bypasses an intended security control but requires specific preconditions (both conflicting directives enabled). Organizations with strict forwarding policies or defense-in-depth requirements should treat this as higher priority than the base score alone suggests.

Frequently asked questions