CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that authenticated SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection. The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

• CWE-20

• https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9399A vulnerability was detected in Edimax BR-6675nD 1.12. This …8.8
• CVE-2026-93990Expat before 2.8.5 fails to validate that a high surrogate i…7.5
• CVE-2026-93991Argo Workflows versions 4.1.0 through 4.1.3 contain an autho…7.7
• CVE-2026-93992Gopeed through 2.0.0-beta.3 contains a path traversal vulner…8.1
• CVE-2026-93993Mistral Vibe before 2.25.5 contains a remote code execution …8.8
• CVE-2026-93994Apache MINA SSHD is a Java library for client-side and serve…8.1
• CVE-2026-93996Uncontrolled resource consumption in component ssd-scp in Ap…6.5
• CVE-2026-93997A weakness has been identified in SourceCodester Drug Recomm…7.3
• CVE-2026-93999A flaw was found in the OIDC protocol implementation of Keyc…4.2
• CVE-2026-9400A flaw has been found in Edimax BR-6675nD 1.12. This issue a…6.3
• CVE-2026-94000A flaw was found in the Admin REST API of Keycloak, an open-…6.6
• CVE-2026-94001A flaw was found in the Admin REST API of Keycloak, an open-…6.5