CVE-2026-59851

Description

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Traduire en français

Produits concernés

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Libssh libssh
• Redhat hardened images
• Redhat enterprise linux

Scores CVSS

Faiblesses (CWE)

• CWE-863

Références

• https://access.redhat.com/errata/RHSA-2026:42922 Issue Tracking
• https://access.redhat.com/errata/RHSA-2026:55855
• https://access.redhat.com/security/cve/CVE-2026-59851 Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2498184 Issue TrackingVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories