OpenSSH flaw enables root access bypass

A vulnerability in OpenSSH before 10.3 allows authentication bypass via malformed certificate principals, granting attackers root access to vulnerable servers.

A critical authentication bypass vulnerability has been discovered in OpenSSH versions prior to 10.3. The flaw stems from improper handling of the authorized_keys principals option when comma characters are present in SSH certificate principal names in conjunction with Certificate Authority configurations. Security researchers at Cyera successfully demonstrated exploitation using a test certificate and server, confirming that attackers possessing a valid certificate from a trusted CA can authenticate as root on vulnerable systems.

The vulnerability represents a severe threat to organizations running affected OpenSSH versions, as successful exploitation grants complete administrative control over vulnerable servers. The issue specifically affects uncommon scenarios involving principals lists combined with certain Certificate Authority configurations that utilize comma characters. This authentication bypass mechanism allows lateral movement across an organization's entire server infrastructure if the vulnerable protocol is widely deployed.

Immediate patching to OpenSSH 10.3 or later is strongly recommended. Organizations should prioritize updates to internet-facing SSH services and implement defense-in-depth measures including network segmentation, least-privilege access controls, and vulnerability scanning to identify affected systems. Given the potential for complete server compromise, this vulnerability warrants urgent attention from security teams managing SSH infrastructure.

title: SSH Root Login via Certificate Authentication with Comma in Principal
id: 2ccf7172-de22-5369-94e6-ba35a4e26e59
status: experimental
description: Detects sshd authentication log entries showing root authenticated via
  a CA-issued certificate where the certificate ID/principal field contains a comma
  character, consistent with exploitation of the OpenSSH principals-handling authentication
  bypass (pre-10.3).
references:
- Cyera OpenSSH authorized_keys principals comma bypass research
logsource:
  category: authentication
  service: sshd
  product: linux
detection:
  selection:
    Message|contains:
    - Accepted publickey for root
    - CERT
  comma_indicator:
    Message|contains: ','
  condition: selection and comma_indicator
fields:
- Message
- SourceIp
- User
falsepositives:
- Legitimate CA-signed certificates that intentionally use multi-value principal fields
  containing commas for valid administrative access
- Custom sshd logging configurations that include comma-separated metadata unrelated
  to principals
level: high
tags:
- attack.t1190
author: Vorant

title: Successful Root SSH Login via Certificate Authentication
id: f52110e4-2bb6-5b31-b6fe-f675f0b0cd32
status: experimental
description: Flags successful root logins authenticated via SSH certificate (CA-signed
  key) rather than password or plain public key. Useful as a compensating detection
  for the OpenSSH principals authentication bypass affecting versions prior to 10.3,
  where any unexpected root certificate login on unpatched hosts should be investigated.
references:
- Cyera OpenSSH authorized_keys principals comma bypass research
logsource:
  category: authentication
  service: sshd
  product: linux
detection:
  selection:
    Message|contains: Accepted publickey for root
  cert_indicator:
    Message|contains:
    - CERT
    - 'CA '
  condition: selection and cert_indicator
fields:
- Message
- SourceIp
falsepositives:
- Authorized administrators using certificate-based SSH access to root accounts as
  part of standard privileged access workflows
- Automated configuration management tools (Ansible, Salt) that legitimately authenticate
  as root via SSH certificates
level: medium
tags:
- attack.t1190
author: Vorant

title: SSH CA Certificate Signing with Comma-Separated Principals
id: d9034c6d-d59e-5cc9-80c4-b5d383e64186
status: experimental
description: Detects ssh-keygen certificate authority signing operations that specify
  a principals list containing embedded comma characters within a single principal
  value, a crafting pattern associated with exploitation attempts against the OpenSSH
  authorized_keys principals authentication bypass (pre-10.3).
references:
- Cyera OpenSSH authorized_keys principals comma bypass research
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /ssh-keygen
    CommandLine|contains:
    - ' -s '
    - ' -n '
  comma_principal:
    CommandLine|re: -n\s+\S*,\S*
  condition: selection and comma_principal
falsepositives:
- Legitimate CA administrators intentionally signing certificates with multiple comma-delimited
  principal names for valid multi-role access
- Automated PKI/certificate issuance pipelines that generate certificates with compound
  principal strings
level: medium
tags:
- attack.t1190
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-openssh-could-allow-for-authentication-bypass_2026-040