OpenSSH before version 10.3 contains a vulnerability (CWE-281) related to improper preservation of file permissions during file downloads using the legacy scp protocol with the -O option and without the -p option when executed as root. Specifically, downloaded files may be installed with setuid or setgid bits set, which can lead to privilege escalation. Red Hat has issued security advisories and updates for affected OpenSSH packages in their Extended Lifecycle Support for RHEL 6. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits in the wild have been reported. The vendor advisory confirms that patches are available and provides instructions for applying updates.

The vulnerability allows files downloaded via scp legacy protocol (with -O and without -p) as root to be installed with setuid or setgid permissions, potentially enabling privilege escalation. This can compromise system security by granting elevated privileges to unauthorized users or processes. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability.

A security update fixing this vulnerability is available from Red Hat for OpenSSH packages in Red Hat Enterprise Linux 6 Extended Lifecycle Support. Users should apply the official patches provided by Red Hat as detailed in their security advisories (RHSA-2026:25063 and RHSA-2026:16059). No additional mitigations are specified or required beyond applying the official update.