8.8

CVE-2026-59851

Libssh: libssh: authentication bypass via missing gssapi principal check

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libssh ≫ Libssh Version-
Redhat ≫ Hardened Images Version-
Redhat ≫ Enterprise Linux Version10.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.216
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://access.redhat.com/security/cve/CVE-2026-59851
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2498184
Vendor Advisory
Issue Tracking
https://access.redhat.com/errata/RHSA-2026:42922
Issue Tracking
https://access.redhat.com/errata/RHSA-2026:55855