{"id":"CVE-2026-59851","aliases":["ALPINE-CVE-2026-59851","ALSA-2026:55855","BELL-CVE-2026-59851","DEBIAN-CVE-2026-59851","EUVD-2026-46268","GHSA-x5cr-v39m-53gw","RHSA-2026:42922","RHSA-2026:55855","RLSA-2026:55855","UBUNTU-CVE-2026-59851"],"status":"published","title":"Libssh: libssh: authentication bypass via missing gssapi principal check","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00489,"percentile":0.42623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-07-21T14:20:47Z","modified":"2026-11-07T02:48:29Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libssh","fixed_in":["0.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh","fixed_in":["0.12.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.12.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.6-r1"},{"fixed":"0.12.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1"}]}],"versions":["0.11.2-1","0.11.3-1","0.12.0-1","0.12.0-2","0.12.0-3"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11}],"products":[{"vendor":"libssh","product":"libssh"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_els"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_els"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_els"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"},{"vendor":"redhat","product":"hardened_images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:42922","tags":["vendor-advisory","x_refsource_REDHAT","Issue Tracking","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55855","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59851","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498184","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59851","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x5cr-v39m-53gw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-59851","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15370","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59842","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59843","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59844","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59845","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59846","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59848","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59849","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59850","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498168","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498176","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498177","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498178","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498179","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498180","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498181","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498182","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498183","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498184","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499049","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55855.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59851","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59851.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59851","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42922.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59842","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59843","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59844","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59845","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59846","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59847","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59848","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59849","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59849","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59850","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59851","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499049","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55855.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15370","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55855","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59851","tags":["report"]},{"url":"https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/","tags":["report"]},{"url":"https://www.libssh.org/security/advisories/CVE-2026-59851.txt","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59851","title":"Libssh: libssh: authentication bypass via missing gssapi principal check","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T14:20:47.001Z","modified":"2026-08-17T21:38:10.967Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-46268","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T14:20:47Z","modified":"2026-11-04T23:09:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-x5cr-v39m-53gw","title":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does...","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T15:30:44Z","modified":"2026-08-18T00:31:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:35.792698Z"}],"nvd":[{"id":"CVE-2026-59851","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T15:16:37.897Z","modified":"2026-11-05T15:54:55.847Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-05T19:55:57.517766Z"}],"osv":[{"id":"ALPINE-CVE-2026-59851","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T15:16:37.897Z","modified":"2026-11-03T06:33:03.89848551Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-59851","status":"published","published":"2026-07-22T06:04:21.364012Z","modified":"2026-07-28T11:54:20.867579Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59851","title":"Libssh: libssh: authentication bypass via missing gssapi principal check","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T14:20:47.001Z","modified":"2026-11-07T02:48:29.58498765Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T03:08:08.148548Z"},{"id":"DEBIAN-CVE-2026-59851","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"published","published":"2026-07-21T15:16:37.897Z","modified":"2026-11-05T09:47:31.659888309Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RHSA-2026:42922","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-23T10:14:19Z","modified":"2026-10-06T10:31:35.349879842Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:55855","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2026-08-18T10:21:15Z","modified":"2026-09-02T10:20:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:55855","title":"Important: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\n* libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)\n\n* libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T12:07:31.722662Z","modified":"2026-08-18T12:30:03.262239025Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-59851","description":"A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.","status":"withdrawn","published":"2026-07-21T15:16:00Z","modified":"2026-08-24T21:19:58.336503637Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:55855","title":"Important: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  \n\nSecurity Fix(es):  \n\n  * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)\n  * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n  * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n  * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n  * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n  * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n  * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n  * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)\n  * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n  * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)\n  * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.455872369Z","updated_at":"2026-11-02T15:27:54.753319Z"}]}}