CVE-2026-106555
Description
A flaw was found in OpenSSH's SSH daemon (sshd). When Generic Security Service Application Program Interface (GSSAPI) authentication is enabled, authentication state can improperly persist across separate authentication attempts. A local user could exploit this condition during sequential authentication sessions to access residual credentials from prior attempts, resulting in an information disclosure.
Statement
This vulnerability is rated as Low impact because exploitation is constrained to systems where GSSAPI authentication is explicitly enabled and yields only limited residual credential data rather than unauthorized access or privilege escalation. The condition requires a specific sequence of an initial failed GSSAPI negotiation followed by a successful secondary authentication method within the same connection. In standard deployments where GSSAPI is disabled or not used in conjunction with fallback authentication methods, the vulnerability cannot be triggered.
Mitigation
Disable GSSAPI authentication in the SSH daemon configuration if Kerberos-based authentication is not required.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 2.2 | 7.5 | 2.2 |
| Attack Vector | Local | Network | Local |
| Attack Complexity | High | Low | High |
| Privileges Required | Low | None | Low |
| User Interaction | Required | None | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | None | Low |
| Integrity Impact | None | High | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
