CVE-2026-59851
Received Received - Intake

libssh GSSAPI Key Exchange Privilege Escalation

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-59851
EUVD
EUVD-2026-46268

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libssh libssh *
libssh libssh From 0.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59851 is a flaw in libssh where servers with GSSAPIKeyExchange enabled fail to verify if an authenticated Kerberos principal is authorized for the requested local user. This allows authenticated clients to bypass user restrictions and log in as any arbitrary user.

Detection Guidance

To detect this vulnerability, check if libssh is running with GSSAPIKeyExchange enabled. Inspect the SSH server configuration for GSSAPIKeyExchange settings. Use commands like 'sshd -T | grep gssapi-keyex' or 'grep -i gssapi-keyex /etc/ssh/sshd_config' to verify if the feature is enabled.

Impact Analysis

This vulnerability enables unauthorized access to systems by allowing attackers with valid Kerberos credentials to impersonate any local user. It compromises system integrity, confidentiality, and availability by granting excessive privileges.

Compliance Impact

This vulnerability likely violates compliance requirements for access control and authentication, such as GDPR's data protection principles and HIPAA's security rules. It undermines user authorization checks, risking unauthorized data access and non-compliance with regulatory standards.

Mitigation Strategies

Disable GSSAPIKeyExchange in the SSH server configuration by setting 'GSSAPIKeyExchange no' in /etc/ssh/sshd_config. Restart the SSH service afterward. Additionally, apply any available patches or updates from libssh to fix the flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart