CVE-2026-60002: OpenSSH Client Use-After-Free in Key Re-Exchange

Technical summary

CVE-2026-60002 is a use-after-free vulnerability (CWE-416) in OpenSSH's client implementation. The flaw occurs when a server initiates a key re-exchange and modifies its host key during this process. The client fails to properly manage memory references to the previous host key, leaving a freed memory pointer accessible. An attacker controlling or intercepting the SSH server can manipulate the re-exchange handshake to trigger the use-after-free condition, potentially reading adjacent memory contents or causing a denial of service through memory corruption.

Business impact

For organizations with SSH infrastructure, this vulnerability poses a confidentiality and integrity risk. Compromised client systems can leak sensitive information from memory—including session tokens, credentials, or application data—during SSH connections to malicious or compromised servers. In environments where users routinely connect to external or untrusted SSH endpoints, the attack surface is elevated. The issue does not directly impact SSH servers, limiting the blast radius, but client-side exploitation could facilitate lateral movement or data exfiltration in connected networks.

Affected systems

OpenBSD OpenSSH versions prior to 10.4 are affected. Any system running a vulnerable OpenSSH client—including Linux distributions, BSD variants, macOS systems, and Windows environments using OpenSSH ports—faces exposure. Enterprise environments should inventory SSH client versions across workstations, jump boxes, automation servers, and CI/CD infrastructure.

Exploitability

Exploitation requires an attacker to intercept or control an SSH server that the victim connects to, or to perform a man-in-the-middle attack on the SSH connection. The CVSS score of 7.7 (HIGH) reflects high attack complexity but network accessibility, lack of authentication requirement, and significant confidentiality impact. While not trivial to exploit, the attack is feasible in targeted scenarios—such as compromised or rogue SSH servers on internal networks or through BGP hijacking or DNS spoofing in external scenarios. Currently, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade OpenSSH to version 10.4 or later on all client systems. Administrators should prioritize systems that frequently initiate SSH connections to external or less-trusted hosts. Parallel mitigations include enforcing strict host key verification policies, using SSH certificates pinned to known good keys, and limiting SSH client usage through firewall rules or network segmentation where feasible.

Patch guidance

Patch availability varies by operating system distribution. Verify the OpenSSH version on each client system using 'ssh -V' and consult your OS vendor for the corresponding patched OpenSSH 10.4+ package. Major Linux distributions and BSD projects should release updates shortly after the vendor advisory; however, confirm the exact patch version against OpenBSD's official OpenSSH release notes to ensure you are deploying a version that addresses this specific issue. Organizations running embedded or minimal SSH clients should review vendor advisories for those products separately.

Detection guidance

Monitor SSH connection logs for abnormal key re-exchange patterns or unexpected disconnections on client systems. Tools such as osquery or endpoint detection and response (EDR) agents can identify OpenSSH versions in use. Network detection is challenging because the flaw manifests in memory, not in clearly anomalous traffic; however, intrusion detection systems may flag suspicious re-exchange sequences if properly tuned. Endpoint logs indicating memory protection violations or segmentation faults in SSH processes warrant investigation. Correlate client-side crashes or anomalies with SSH connection attempts to potentially compromised servers.

Why prioritize this

This vulnerability merits urgent but measured attention. The HIGH CVSS score (7.7), combined with confidentiality and integrity impact, justifies priority patching. However, because it requires an attacker-controlled or compromised server and does not expose SSH servers directly, it ranks below critical vulnerabilities. Organizations should prioritize patching systems in high-trust or frequently-used SSH client roles (developers, administrators, automation servers) before general infrastructure. The absence of known public exploits and KEV listing reduces near-term pressure but does not eliminate the need for timely remediation.

Risk score, explained

The CVSS v3.1 score of 7.7 (HIGH) is driven by: (1) Network-based attack vector—the flaw can be triggered remotely over SSH; (2) High attack complexity—exploitation requires either server control or active interception; (3) No privileges or user interaction required; (4) Confidentiality impact marked as HIGH due to potential memory leakage; (5) Integrity impact as HIGH because memory corruption could allow state manipulation; and (6) Low availability impact as a secondary effect of memory corruption. The overall rating reflects a serious but not immediately exploitable flaw.

Frequently asked questions