CVE-2026-110925: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Hardened Images

The vulnerability in OpenSSH on Red Hat Enterprise Linux 10 involves improper neutralization of special elements used in OS command execution. Specifically, when a username containing '$' or a non-trailing backslash is expanded via %u in ProxyCommand or Match exec directives, these characters are passed directly into the shell without proper sanitization. This can lead to OS command injection, potentially allowing an attacker to execute unintended commands in the context of the SSH client or server process.

The vulnerability allows an attacker to inject OS commands via specially crafted usernames in SSH command line usage, potentially compromising confidentiality and integrity of the affected system. However, the CVSS score of 5.4 indicates a medium impact with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-110925 for current remediation guidance. Until a fix is available, avoid using untrusted usernames containing special shell characters in ProxyCommand or Match exec configurations.