CVE-2026-110924
Received Received - Intake

OpenSSH GSSAPI Authentication Credential Leak Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-110924
EUVD
EUVD-2026-102054

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 6 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110924 is a flaw in OpenSSH where GSSAPI authentication leaves delegated credentials stored even after a failed attempt. When GSSAPIAuthentication is enabled, a partial exchange stores credentials like exported names and credentials via ssh_gssapi_storecreds without proper user authorization. This creates a leftover state that may affect later successful logins on the same connection.

Detection Guidance

Check if GSSAPIAuthentication is enabled in OpenSSH configuration by running: grep GSSAPIAuthentication /etc/ssh/sshd_config. If enabled, verify if GSSAPIDelegateCredentials is set to yes in /etc/ssh/sshd_config. Look for failed GSSAPI attempts in system logs like /var/log/secure or /var/log/auth.log.

Impact Analysis

This vulnerability could allow stored delegated credentials to be reused in later sessions, potentially leading to unauthorized access if an attacker exploits the leftover state. It may compromise confidentiality and integrity by permitting access without proper authorization. Systems with GSSAPI enabled by default, like RHEL, are more exposed unless mitigated.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and auditability, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized credential storage and potential access breaches could lead to non-compliance, data exposure, or audit failures if exploited.

Mitigation Strategies

Disable GSSAPIDelegateCredentials by setting it to no in /etc/ssh/sshd_config. Alternatively, disable GSSAPIAuthentication entirely if not required. Restart the SSH service with systemctl restart sshd. Monitor logs for unusual authentication attempts after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart