OpenSSH Certificate Bug Enables Root Bypass
A flaw in OpenSSH's handling of comma characters in certificate principals lets attackers with a trusted CA certificate authenticate as root.
CISA's MS-ISAC issued an advisory on CVE-2026-35414, a vulnerability in OpenSSH versions prior to 10.3 affecting how the authorized_keys principals option processes certificate principal names. When a Certificate Authority's certificate principal list contains comma characters in specific configurations, OpenSSH's access control logic can be bypassed, allowing an attacker holding a valid certificate from a trusted CA to authenticate as root on the affected server.
The issue was identified by researcher Cyera, who successfully demonstrated exploitation using a test certificate and test server, though there is no indication of active exploitation in the wild. Because OpenSSH is broadly deployed for remote administration across virtually all sectors, successful exploitation could grant an attacker root access to any server running the vulnerable configuration, making this a high-impact issue for environments relying on certificate-based SSH authentication with CA-signed principals.
Organizations running affected OpenSSH versions should prioritize patching to 10.3 or later, apply least-privilege principles to limit blast radius, and review CA-issued certificate principal configurations for unusual comma usage as a mitigating step pending patch deployment.
Mentioned in this report
Detection guidance
SSH Root Authentication via Certificate Principal Bypass
Detects successful SSH authentication as root user following certificate-based login, indicative of principal-validation bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Root Authentication via Certificate Principal Bypass
description: Detects SSH authentication attempts resulting in root access via certificate
principals, potentially indicating exploitation of OpenSSH CVE-2026-35414 where
malformed principals bypass access control.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: authentication
product: linux
service: sshd
detection:
selection:
EventType|contains:
- Accepted
- Accepted publickey
User: root
AuthMethod|contains:
- publickey
- certificate
filter_expected_admin:
SourceIP:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_expected_admin
falsepositives:
- Legitimate administrative SSH access from certificate-based automation
- Scheduled certificate-authenticated root maintenance tasks
level: high
id: d19f65e3-a6c3-5acc-8aca-824488bb6678
status: experimental
author: Vorant
SSH Certificate Principal Containing Comma Character
Detects SSH certificate principal names containing comma characters, matching the OpenSSH CVE-2026-35414 bypass condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Certificate Principal Containing Comma Character
description: Detects SSH certificate-based authentication where the principals field
contains comma characters, the core condition enabling CVE-2026-35414 principal
validation bypass.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: authentication
product: linux
service: sshd
detection:
selection:
EventType|contains: Accepted publickey
AuthMethod: certificate
CertificatePrincipal|contains: ','
condition: selection
falsepositives:
- Certificates intentionally issued with comma-delimited principal lists by some CAs
- Custom certificate principal formats in specialized authentication systems
level: medium
id: dd6d0833-6a44-55a4-9674-e142f81b94bc
status: experimental
author: Vorant
Unexpected Root SSH Certificate Authentication
Detects SSH certificate-based authentication to root account from non-administrative IP ranges, a deviation from normal certificate-based access patterns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unexpected Root SSH Certificate Authentication
description: Detects certificate-based SSH authentication attempts to root user from
sources outside trusted administrative ranges, potentially indicating certificate-based
unauthorized access or principal-validation bypass exploitation.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: authentication
product: linux
service: sshd
detection:
selection:
EventType|contains:
- Accepted
- Accepted publickey
User: root
AuthMethod|contains: certificate
filter_trusted_ranges:
SourceIP:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
filter_localhost:
SourceIP:
- 127.0.0.1
- ::1
condition: selection and not filter_trusted_ranges and not filter_localhost
falsepositives:
- Certificate-authenticated remote vendor support from external IPs
- Legitimate off-network certificate-based administrative access
level: high
id: 8a1a536e-9ab6-5229-88de-bb1816c57fa9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-openssh-could-allow-for-authentication-bypass_2026-040
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free