Improper input validation in sshd-git in Apache MINA SSHD. (CVE-2026-58624)
Description
An improper input validation vulnerability exists in the GitPgmCommandFactory component of Apache MINA SSHD, a Java SSH library. This flaw allows authenticated SSH users to execute any JGit command, including those that can write files arbitrarily on the server, such as git archive with the --output option. The vulnerability affects SSH servers using Apache MINA SSHD with GitPgmCommandFactory configured. The issue is fixed in Apache MINA SSHD versions 2.19.0 and 3.0.0-M5 by restricting commands to a safe whitelist and ignoring the --output argument for git archive.
CVSS v3.1
Score 5.4medium
Affected software
pkg:deb/ubuntu/mina?arch=source&distro=xenialpkg:deb/ubuntu/mina2?arch=source&distro=xenialpkg:deb/ubuntu/mina?arch=source&distro=bionicpkg:deb/ubuntu/mina2?arch=source&distro=bionicpkg:deb/ubuntu/mina?arch=source&distro=focalpkg:deb/ubuntu/mina2?arch=source&distro=focalpkg:deb/ubuntu/mina?arch=source&distro=jammypkg:deb/ubuntu/mina2?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/mina?arch=source&distro=noblepkg:deb/ubuntu/mina2?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/mina2?arch=source&distro=stonkingpkg:deb/ubuntu/mina2?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58624 describes an improper input validation vulnerability in the sshd-git component of Apache MINA SSHD. The GitPgmCommandFactory allows authenticated SSH clients to execute any JGit command, including potentially dangerous commands that can write files to arbitrary locations on the server. This occurs because the factory did not restrict the commands available to the user. The vulnerability is mitigated by upgrading to Apache MINA SSHD 2.19.0 or 3.0.0-M5, where the command set is restricted to a whitelist of safe commands and the --output option of git archive is ignored, ensuring archives are sent only through the SSH channel.
Potential Impact
An authenticated SSH user on a server using the vulnerable GitPgmCommandFactory can execute arbitrary JGit commands, including those that write files to arbitrary locations on the server. This can lead to integrity and availability impacts on the server. The CVSS v3.1 score is 5.4 (medium severity), reflecting limited scope due to required authentication but potential for command misuse.
Mitigation Recommendations
Upgrade affected Apache MINA SSHD servers to version 2.19.0 or 3.0.0-M5 or later, where the vulnerability is fixed by restricting available JGit commands to a safe whitelist and ignoring the --output argument for git archive. If the GitPgmCommandFactory is not configured on the server, no action is required as the server is not affected.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-58624
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5dd2cdf04f656663466
Added to database: 10/17/2026, 22:25:33 UTC
Last enriched: 10/18/2026, 00:31:48 UTC
Last updated: 10/18/2026, 00:31:48 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.