CVE-2026-35386 is a security vulnerability identified in OpenSSH versions prior to 10.3, categorized under CWE-696 (Incorrect Behavior Order). The flaw stems from improper handling of shell metacharacters embedded within usernames when these usernames are passed on the command line. Specifically, if an untrusted username containing shell metacharacters is used in conjunction with a non-default ssh_config setting involving the '%' character, it can lead to unintended command execution. This vulnerability requires a scenario where the username is not sanitized and is supplied in a context that allows shell interpretation, which is uncommon in default configurations. The attack vector is local (AV:L), with high attack complexity (AC:H), requiring low privileges (PR:L) but no user interaction (UI:N). The vulnerability impacts confidentiality and integrity by potentially allowing unauthorized command execution, but it does not affect availability. No known exploits have been reported in the wild, and no patches have been linked yet. The issue highlights the risks of non-default ssh_config customizations and the importance of input validation for usernames in command-line contexts.

The potential impact of CVE-2026-35386 is limited but significant in specific environments. Successful exploitation could allow an attacker with low privileges to execute arbitrary commands by injecting shell metacharacters through a crafted username, potentially leading to unauthorized information disclosure or modification. However, the vulnerability requires non-default ssh_config settings and untrusted username input, which reduces the attack surface. Organizations that rely on automated systems, scripts, or multi-tenant environments where usernames might be externally controlled or dynamically generated are at higher risk. The impact on confidentiality and integrity could lead to data leaks or unauthorized changes, but availability remains unaffected. Given the low CVSS score and high attack complexity, widespread exploitation is unlikely, but targeted attacks in sensitive environments could be damaging.

To mitigate CVE-2026-35386, organizations should: 1) Avoid using untrusted or externally supplied usernames in command-line contexts, especially when ssh_config uses non-default '%' expansions. 2) Review and revert any custom ssh_config settings involving '%' that are not strictly necessary. 3) Implement strict input validation and sanitization for usernames to prevent shell metacharacter injection. 4) Monitor OpenSSH releases and apply patches promptly once available. 5) Employ least privilege principles to limit the impact of potential exploitation. 6) Use alternative authentication mechanisms or configurations that do not rely on potentially unsafe username expansions. 7) Conduct security audits focusing on ssh_config customizations and username handling in automated scripts or systems.