In OpenSSH through version 10.6, the sshd daemon can unintentionally obtain root privileges in operating systems such as QNX 6 and SCO OpenServer 5 when the GatewayPorts and StreamLocalForwarding options are enabled. The flaw arises because these platforms do not support file‑descriptor passing and do not allow unprivileged processes to allocate PTY devices, so the server runs with elevated rights without explicit root authorization. If an attacker can influence these settings or trigger the forward session, they may acquire full control over the host.

The affected product is OpenBSD's OpenSSH implementation up to and including 10.6 on the QNX 6 and SCO OpenServer 5 platforms. Any installation running those operating systems with GatewayPorts or StreamLocalForwarding enabled is at risk. The vulnerability applies to all releases of OpenSSH 10.6 or earlier, as the fix was introduced after this version.

The CVSS score of 2.9 indicates a low overall impact, and the EPSS score of < 1% indicates a very low probability of exploitation. KEV entry is not listed. The attack vector is most likely remote via the SSH service: an attacker who can create a forwarding request or alter the configuration while authenticated with a low‑privileged account may trigger the privilege escalation. Because the flaw is limited to specific environments, the systemic risk is moderate, but the potential to achieve full root access mandates timely remediation.