5.4

CVE-2026-58624: apache software foundation apache mina sshd Improper Input Validation

CVSS: 5.4v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-58624DEBIAN-CVE-2026-58624
Published 20-07-2026Last modified 21-07-2026
Open JSON

Vulnerability summary

CVE-2026-58624 is a medium (CVSS 5.4) Improper Input Validation vulnerability in apache software foundation apache mina sshd. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.4% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.64%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2026:11327-1SUSE-SU-2026:3339-1

Timeline

  1. 20-07-2026
    PublishedVulnerability first disclosed.
  2. 21-07-2026
    Last modifiedVulnerability information updated.

Description

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue. The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.64%

Chance of exploitation in the next 30 days

Percentile

49%

Versus all other CVEs

30-day change

0.00 pp

From 0.64% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.64%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu2 products
  • minaAll versions (No fix recorded)
  • mina2All versions (No fix recorded)
Apache1 product
  • mina_sshd≥ 2.0.0, < 2.19.0 | 3.0.0:m1 | 3.0.0:m2 | 3.0.0:m3 | 3.0.0:m4
Apache software foundation1 product
Debian1 product
  • libmina-sshd-javaAll versions (No fix recorded)

4 vendors · 5 products

References

6 links