Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-106586
OpenBSD OpenSSH — In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not,…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U N L N 4.3 .0012 1.9 —
AFFECTED
Product Versions Fixed
OpenSSH unspecified —
TIMELINE
Oct 6 Reserved by mitre
Oct 6 Published (CNA: mitre)
Oct 13 RESCORED — CVE-2026-106586 (OpenBSD OpenSSH). CVSS 2.5 → 4.3 (NVD).
Description
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 6, 2026 | Reserved | Reserved by mitre |
| October 6, 2026 | Published | Published (CNA: mitre) |
| October 13, 2026 | RESCORED | RESCORED — CVE-2026-106586 (OpenBSD OpenSSH). CVSS 2.5 → 4.3 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| OpenBSD | OpenSSH | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-106586 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
