Read the docs
TI-2026-42667 Aliases CVE-2026-59851GHSA-x5cr-v39m-53gw

Libssh: libssh: authentication bypass via missing gssapi principal check

Priority MEDIUM 41CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00489 42nd percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 10—0.12.0-3.el10_2Patch availableCNA
Red HatRed Hat Hardened Images—0.12.1-4.hum1Patch availableCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
Red HatRed Hat Enterprise Linux 9——Not affectedCNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 0.12.0-3.el10_2 Patch available CNA
  • Red Hat Hardened Images VendorRed Hat Affected — Fixed in 0.12.1-4.hum1 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:*0.12.0Vulnerablelibssh
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x86:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x86:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:10.2:*:*:*:*:*:arm64:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*10.2VulnerableRed Hat
  • cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:* Versions 0.12.0 Vulnerable ·libssh
  • cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x86:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x86:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.2:*:*:*:*:*:arm64:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:* Versions 10.2 Vulnerable ·Red Hat
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:*10.0_s390xVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:*10.0_ppc64leVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*10.2VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2026:55855 Released 2026-08-17 · Red Hat rating Important
    libssh security update
    • Red Hat Enterprise Linux AppStream (v. 10) libssh-devel-0.12.0-3.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) libssh-0.12.0-3.el10_2, libssh-config-0.12.0-3.el10_2
  • RHSA-2026:42922 Released 2026-07-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libssh-0.12.1-4.hum1@aarch64, libssh-0.12.1-4.hum1@src, libssh-0.12.1-4.hum1@x86_64 +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and 2 more products — RHSA-2026:55855

    11 records Highest priority Priority MEDIUM 1 MEDIUM, 10 LOW

    Other records, highest priority first

    • TI-2026-42663 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verificationPriority LOW 39
    • TI-2026-42666 Libssh: libssh: use-after-free via data callbacks on closed channelsPriority LOW 33
    • TI-2026-42665 Libssh: libssh: denial of service via automatic certificate authentication loopPriority LOW 33
    Show all 11 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and 2 more products — RHSA-2026:42922

    10 records Highest priority Priority MEDIUM 1 MEDIUM, 9 LOW

    Other records, highest priority first

    • TI-2026-42663 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verificationPriority LOW 39
    • TI-2026-42666 Libssh: libssh: use-after-free via data callbacks on closed channelsPriority LOW 33
    • TI-2026-42665 Libssh: libssh: denial of service via automatic certificate authentication loopPriority LOW 33
    Show all 10 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:55855
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:55855
Red Hat Hardened ImagesFixed RHSA-2026:42922
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59851
  2. 2026-10-03 Alias added: GHSA-x5cr-v39m-53gw

References

Advisory 4

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences