CVE-2026-35414 is a vulnerability in OpenSSH affecting versions released over the past 15 years. It arises from a code reuse error where comma characters in SSH certificate principals are treated as list separators during authentication. This causes the server to incorrectly grant root access if a principal contains a comma-separated value like 'deploy,root'. The flaw allows an attacker possessing a valid certificate from a trusted certificate authority to bypass access controls and gain full root shell access. The authentication bypass does not trigger log-based detection mechanisms, complicating incident identification. The issue was resolved in OpenSSH 10.3 in early April 2026.

Successful exploitation grants an attacker full root shell access on vulnerable OpenSSH servers, potentially compromising all servers within an organization using affected versions. The bypass of authentication controls occurs without generating authentication failure logs, reducing the likelihood of detection through standard log monitoring. This elevates the risk of undetected privilege escalation and system compromise.

A fix for this vulnerability is available in OpenSSH version 10.3 released in early April 2026. Organizations should audit their environments to identify affected OpenSSH versions and update to version 10.3 or later as soon as possible. No alternative mitigations are indicated. Patch status is confirmed by the vendor advisory.