OpenSSH before version 10.3 improperly handles the authorized_keys principals option when used in uncommon scenarios involving a principals list combined with a Certificate Authority that makes certain use of comma characters. This mishandling can lead to limited confidentiality and integrity impacts. The vulnerability affects several Ubuntu versions and their Pro/FIPS variants prior to their respective patched versions. There is no indication of known exploits in the wild. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact.

The vulnerability could allow an attacker with low privileges and network access to cause limited confidentiality and integrity issues related to the authorized_keys principals option in OpenSSH. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Ubuntu and OpenSSH advisories for updates and apply patches when available. Until then, avoid using principals lists with Certificate Authorities that use comma characters in the authorized_keys configuration in affected versions.