Severity: medium (Ubuntu), all five; CVSS3 vectors in the working pages.
apt-cache policy openssh-server on both boxes: Installed: 1:10.2p1-2ubuntu3.8 / Candidate: 1:10.2p1-2ubuntu3.8
— Ubuntu ships no newer build, so each OSV record has an introduced event and no fixed event:
Action: watch the tracker (curl -s https://ubuntu.com/security/cves/CVE-2026-110923.json → notices_ids)
and apply the USN when it lands in the same window as the F1 key-only cutover — disabling PasswordAuthentication retires the client-side rows (110923/110925) as an attack surface on the
fleet's own accounts.
**Severity:** medium (Ubuntu), all five; CVSS3 vectors in the working pages.
`apt-cache policy openssh-server` on both boxes: `Installed: 1:10.2p1-2ubuntu3.8 / Candidate: 1:10.2p1-2ubuntu3.8`
— Ubuntu ships no newer build, so each OSV record has an `introduced` event and **no `fixed` event**:
| CVE | Subject | Fix state |
|---|---|---|
| [CVE-2026-110923](https://ubuntu.com/security/CVE-2026-110923) | sftp client: malicious server name handling | `needs-triage`, no USN (Red Hat has RHSA-2026:82247) |
| [CVE-2026-110924](https://ubuntu.com/security/CVE-2026-110924) | GSSAPI auth failure leaves inconsistent state | not published |
| [CVE-2026-110925](https://ubuntu.com/security/CVE-2026-110925) | ssh command-line username keeps `$`/special chars | not published |
| [CVE-2026-110926](https://ubuntu.com/security/CVE-2026-110926) | compression: channels on one connection share state | not published |
| [CVE-2026-110927](https://ubuntu.com/security/CVE-2026-110927) | compressed payload can expand past limit | not published |
**Action:** watch the tracker (`curl -s https://ubuntu.com/security/cves/CVE-2026-110923.json` → `notices_ids`)
and apply the USN when it lands in the same window as the F1 key-only cutover — disabling
`PasswordAuthentication` retires the client-side rows (110923/110925) as an attack surface on the
fleet's own accounts.
Sources: [vuln-dankclaw.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankclaw.md) · [vuln-dankserver.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankserver.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Taking ownership (agent). Nothing installable today: Ubuntu ships no newer build, so the five rows are watch-state. Watch fires with the F1 key-only cutover (retires the two client-side rows as fleet attack surface).
**Taking ownership (agent).** Nothing installable today: Ubuntu ships no newer build, so the five rows are watch-state. Watch fires with the F1 key-only cutover (retires the two client-side rows as fleet attack surface).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium (Ubuntu), all five; CVSS3 vectors in the working pages.
apt-cache policy openssh-serveron both boxes:Installed: 1:10.2p1-2ubuntu3.8 / Candidate: 1:10.2p1-2ubuntu3.8— Ubuntu ships no newer build, so each OSV record has an
introducedevent and nofixedevent:needs-triage, no USN (Red Hat has RHSA-2026:82247)$/special charsAction: watch the tracker (
curl -s https://ubuntu.com/security/cves/CVE-2026-110923.json→notices_ids)and apply the USN when it lands in the same window as the F1 key-only cutover — disabling
PasswordAuthenticationretires the client-side rows (110923/110925) as an attack surface on thefleet's own accounts.
Sources: vuln-dankclaw.md · vuln-dankserver.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Nothing installable today: Ubuntu ships no newer build, so the five rows are watch-state. Watch fires with the F1 key-only cutover (retires the two client-side rows as fleet attack surface).