CVE-2026-59851
Libssh: libssh: authentication bypass via missing gssapi principal check
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Libssh: libssh: authentication bypass via missing gssapi principal check
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-46268
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
EUVD-2026-46268- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-x5cr-v39m-53gw
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does...
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
GHSA-x5cr-v39m-53gw- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-05
OSVALPINE-CVE-2026-59851
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
ALPINE-CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-59851
- Record
BELL-CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSV
Libssh: libssh: authentication bypass via missing gssapi principal check
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-59851
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
DEBIAN-CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVRHSA-2026:42922
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:42922- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:55855
Red Hat Security Advisory: libssh security update
- Record
RHSA-2026:55855- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:55855
Important: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
-
libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)
-
libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)
-
libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)
-
libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)
-
libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)
-
libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)
-
libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)
-
libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)
-
libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)
-
libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)
-
libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:55855- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-59851
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- Record
UBUNTU-CVE-2026-59851- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:55855 No score
Important: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.
Security Fix(es):
- libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)
- libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)
- libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)
- libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)
- libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)
- libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)
- libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)
- libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)
- libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)
- libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)
- libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:55855- Updated
- 2026-11-02
Affected products
- libssh
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat hardened images
- redhat enterprise linux
- redhat enterprise linux eus
- redhat enterprise linux for els
- redhat enterprise linux for ibm z systems
- redhat enterprise linux for ibm z systems els
- redhat enterprise linux for ibm z systems eus
- redhat enterprise linux for power little endian
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsshAlpine:v3.24 |
before 0.12.1-r0 | 0.12.1-r0 |
libsshAlmaLinux:10 From an advisory covering 11 CVEs |
before 0.12.0-3.el10_2 | 0.12.0-3.el10_2 |
libssh-configAlmaLinux:10 From an advisory covering 11 CVEs |
before 0.12.0-3.el10_2 | 0.12.0-3.el10_2 |
libssh-develAlmaLinux:10 From an advisory covering 11 CVEs |
before 0.12.0-3.el10_2 | 0.12.0-3.el10_2 |
libsshAlpaquita:stream |
0.9.6-r1 up to 0.12.1-r0 | 0.12.1-r0 |
libsshDebian:14 |
before 0.12.1-1, plus listed versions 0.11.2-10.11.3-10.12.0-10.12.0-20.12.0-3 |
0.12.1-1 |
libsshRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:0.12.1-4.hum1 | 0:0.12.1-4.hum1 |
libssh-configRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:0.12.1-4.hum1 | 0:0.12.1-4.hum1 |
libssh-develRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:0.12.1-4.hum1 | 0:0.12.1-4.hum1 |
libssh-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 0:0.12.0-3.el10_2 | 0:0.12.0-3.el10_2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libssh-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 0:0.12.0-3.el10_2 | 0:0.12.0-3.el10_2 |
libssh-develRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 0:0.12.0-3.el10_2 | 0:0.12.0-3.el10_2 |
libsshRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 0:0.12.0-3.el10_2 | 0:0.12.0-3.el10_2 |
libssh-configRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 0:0.12.0-3.el10_2 | 0:0.12.0-3.el10_2 |
libsshRocky Linux:10 From an advisory covering 11 CVEs |
before 0:0.12.0-3.el10_2 | 0:0.12.0-3.el10_2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected | ||
| products, references | NVD, OSV | |
| facts | EUVD | |
| affected, aliases, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59851 is a high vulnerability (CVSS 8.8) in Libssh, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in libssh 0.12.1-r0.
References
access.redhat.com/errata/RHSA-2026:42922
bugzilla.redhat.com/show_bug.cgi?id=2498184
nvd.nist.gov/vuln/detail/CVE-2026-59851
github.com/advisories/GHSA-x5cr-v39m-53gw
Show 67 moreShow less
security.alpinelinux.org/vuln/CVE-2026-59851
errata.almalinux.org/10/ALSA-2026-55855.html
docs.bell-sw.com/security/cves/CVE-2026-59851
catalog.redhat.com/software/containers
security-tracker.debian.org/tracker/CVE-2026-59851
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42922.json
cve.org/CVERecord?id=CVE-2026-59842
errata.rockylinux.org/RLSA-2026:55855
ubuntu.com/security/CVE-2026-59851
libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases