CVE-2026-56624 describes a vulnerability in Apache MINA SSHD where server-side OpenSSH user certificate validation did not verify unsupported options like force-command or verify-required embedded in the certificate. This improper validation could allow a user to authenticate with a certificate containing a force-command option but still execute other commands beyond the forced command. The vulnerability affects versions 2.0.0, 3.0.0-M1, and all versions from 2.0.0 through 2.18.0. The Apache Software Foundation fixed this issue in versions 2.19.0 and 3.0.0-M5 by rejecting certificates that include these unsupported options.

Successful exploitation allows a user to bypass intended command restrictions imposed by the force-command option in OpenSSH user certificates, potentially executing unauthorized commands on the server. This can lead to unauthorized command execution with the privileges of the authenticated user, impacting confidentiality and integrity. The CVSS v3.1 score is 7.3 (High), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with high confidentiality and integrity impact but no availability impact.

Upgrade Apache MINA SSHD to version 2.19.0 or later, or 3.0.0-M5 or later, where the vulnerability is fixed by rejecting OpenSSH user certificates containing unsupported force-command or verify-required options. No other mitigations are specified or recommended by the vendor. Patch status is confirmed fixed in these versions.