OpenSSH prior to version 10.4 contains an argument-parsing flaw in its internal-sftp subprocess: only the first nine command-line arguments are recognized, and any following arguments are silently discarded. When later arguments are required to enforce security properties such as user restrictions or permission constraints, those safeguards can be omitted, allowing a client to initiate an SFTP session that bypasses intended authorization controls. This weakness is identified as CWE-1284 and CWE-88.

The vulnerability affects OpenBSD OpenSSH installations running any release before 10.4. Users who rely on the internal-sftp command for controls are at risk.

The CVSS score of 4.2 indicates a low overall severity, and the EPSS score of <1 % suggests a very low likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. It is inferred that the most likely attack vector involves an adversary who can influence sshd—for example, through local compromise of configuration files or privileged access to restart the service. Exploitation requires the ability to alter the sshd launch parameters and knowledge of which arguments normally enforce security controls, thereby limiting the attack surface but still warranting remediation.