Audit ssh attack surface for CVE-2026-35414 OpenSSH commas-in-cert-principals #71

New issue

Closed

opened 2026-05-23 20:54:37 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-23 20:54:37 +00:00

Owner

Originally filed by @coilysiren on 2026-05-03T19:53:52Z - https://github.com/coilysiren/infrastructure/issues/90

🤖 Filed by Claude Code on Kai's behalf.

CVE-2026-35414 surfaced in TLDR (2026-04-28): a 15-year-old OpenSSH bug where a code-reuse error allows commas in SSH certificate principals, breaking principal-based authorization. Worth a quick audit because coily ssh kai-server is the daily privileged path into the homelab.

What to check

sshd version on kai-server vs the CVE's affected range. ssh -V locally and ssh kai-server 'sshd -V 2>&1 || /usr/sbin/sshd -V 2>&1'.
Whether kai-server's sshd actually uses cert-based auth with principals constraints, or just plain authorized_keys. If it's authorized_keys only, this CVE is not exploitable here. (Pretty sure it's the latter, but verify.)
Same check on any other host coily reaches (GH Actions runners that ssh in, etc.).
If affected: pin the upgrade path. Debian/Ubuntu security backport vs source build.

Relation to gauntlet

Tangentially related, not a direct gauntlet trial:

gauntlet attacks HTTP APIs for authorization/ownership/input invariants. SSH cert-principal parsing is out of scope for the current gauntlet shape (no HTTP surface).
BUT the underlying pattern - "auth identifier parser accepts a delimiter that the authz layer treats as a separator" - is exactly the class of bug gauntlet's Inspector should be primed to look for in HTTP services. Worth adding a recurring-failure pattern to gauntlet's prior catalog: delimiter-injection in identity claims (commas, semicolons, nulls, unicode lookalikes inside usernames/org-slugs/principal lists that get split or joined downstream).
Action item if confirmed valuable: open a follow-up in coilysiren/gauntlet to seed an attacker plan template around delimiter injection in identity fields.

Other items from the same TLDR (lower priority, not blocking)

Checkmarx GitHub-org compromise: review whether any coilysiren/* repo has Checkmarx as an installed app/integration. If yes, audit + rotate.
CloudFlare AI-reviewer rollout: not actionable, just market signal.

Source

TLDR newsletter, dan@tldrnewsletter.com, 2026-04-28. Item titled "15-Year OpenSSH Root Bug, Checkmarx GitHub Breach, CloudFlare AI Reviews At Scale."

🤖 Filed by Claude Code on Kai's behalf.

Moved from coilysiren/coilyco-ai#23.

_Originally filed by @coilysiren on 2026-05-03T19:53:52Z - [https://github.com/coilysiren/infrastructure/issues/90](https://github.com/coilysiren/infrastructure/issues/90)_ > 🤖 Filed by Claude Code on Kai's behalf. CVE-2026-35414 surfaced in TLDR (2026-04-28): a 15-year-old OpenSSH bug where a code-reuse error allows commas in SSH certificate principals, breaking principal-based authorization. Worth a quick audit because `coily ssh kai-server` is the daily privileged path into the homelab. ## What to check - [ ] sshd version on `kai-server` vs the CVE's affected range. `ssh -V` locally and `ssh kai-server 'sshd -V 2>&1 || /usr/sbin/sshd -V 2>&1'`. - [ ] Whether kai-server's sshd actually uses cert-based auth with `principals` constraints, or just plain authorized_keys. If it's authorized_keys only, this CVE is not exploitable here. (Pretty sure it's the latter, but verify.) - [ ] Same check on any other host coily reaches (GH Actions runners that ssh in, etc.). - [ ] If affected: pin the upgrade path. Debian/Ubuntu security backport vs source build. ## Relation to gauntlet Tangentially related, not a direct gauntlet trial: - gauntlet attacks HTTP APIs for authorization/ownership/input invariants. SSH cert-principal parsing is out of scope for the current gauntlet shape (no HTTP surface). - BUT the underlying pattern - "auth identifier parser accepts a delimiter that the authz layer treats as a separator" - is exactly the class of bug gauntlet's Inspector should be primed to look for in HTTP services. Worth adding a recurring-failure pattern to gauntlet's prior catalog: **delimiter-injection in identity claims** (commas, semicolons, nulls, unicode lookalikes inside usernames/org-slugs/principal lists that get split or joined downstream). - Action item if confirmed valuable: open a follow-up in `coilysiren/gauntlet` to seed an attacker plan template around delimiter injection in identity fields. ## Other items from the same TLDR (lower priority, not blocking) - Checkmarx GitHub-org compromise: review whether any coilysiren/* repo has Checkmarx as an installed app/integration. If yes, audit + rotate. - CloudFlare AI-reviewer rollout: not actionable, just market signal. ## Source TLDR newsletter, dan@tldrnewsletter.com, 2026-04-28. Item titled "15-Year OpenSSH Root Bug, Checkmarx GitHub Breach, CloudFlare AI Reviews At Scale." > 🤖 Filed by Claude Code on Kai's behalf. --- *Moved from coilysiren/coilyco-ai#23.*

coilysiren added the

label

2026-06-04 08:16:55 +00:00

coilysiren commented

2026-06-17 08:22:46 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:22:46 +00:00