This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-59999 →
UBUNTU-CVE-2026-59999
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Original description
The description as published by the source.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:FIPS-updates:16.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS:16.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.7+esm6"}]}]
Ubuntu:18.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:18.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS:18.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+esm3"}]}]
Ubuntu:20.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:20.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS:20.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16"}]}]
Ubuntu:22.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-preview:22.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:22.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.16+Fips3"}]}]
Ubuntu:24.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18"}]}]
Ubuntu:24.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:FIPS-updates:24.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.18+Fips1"}]}]
Ubuntu:25.10
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:25.10
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2p1-2ubuntu3.4"}]}]
Ubuntu:26.04:LTS
openssh-ssh1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report openssh.org