Loading vulnerability…
libssh GSSAPIKeyExchange Authorization Bypass
CVE-2026-59851 is an authorization bypass in libssh server deployments that enable GSSAPIKeyExchange. The gssapi-keyex authentication path accepts an authenticated Kerberos principal without verifying that the principal is authorized to access the local user account requested during login. Consequently, a Kerberos-authenticated client can request and obtain a session as an arbitrary local user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker can impersonate arbitrary local accounts, potentially including privileged accounts such as root. This can result in complete compromise of the affected host's confidentiality, integrity, and availability within the privileges available to the impersonated account.
If you can’t patch tonight, do this now.
Disable GSSAPIKeyExchange on affected libssh servers until the fixed libssh version is installed. Restrict network access to SSH services and Kerberos-authenticated clients as a defense-in-depth measure.
Patch, then assume compromise.
Upgrade to a libssh release containing the fix. libssh 0.12.1 addresses CVE-2026-59851. For Red Hat Enterprise Linux 10, apply the vendor security update providing libssh version 0.12.0-3.el10_2 or a later supported package release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.