CVE-2026-59846 — Libssh: libssh: information disclosure via proxycommand %r username expansion
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing uninten…
Published: 2026-07-21 · CVSS: 3.9 · CVSS 3.1
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7