high8.8
CVE-2026-59851
A flaw was found in libssh.
Impact
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Libssh | Libssh | All versions |
| Redhat | Hardened Images | All versions |
| Redhat | Enterprise Linux | Version 10.0 |