CVE-2026-59851

Published: Jul 21, 2026Modified: Aug 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Affected (3)

Products: Libssh: Libssh · Redhat: Enterprise Linux, Hardened Images

1 product

2 products

Enterprise Linux

Hardened Images

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Libssh Libssh	All versions
Redhat Enterprise Linux	Version 10.0
Redhat Hardened Images	All versions

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://access.redhat.com/errata/RHSA-2026:42922

Source: secalert@redhat.com

Issue Tracking

https://access.redhat.com/errata/RHSA-2026:55855

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-59851

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2498184

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.