CVE-2026-106553: High severity OpenSSH OpenSSH vulnerability

Q: What access and conditions are required to exploit this issue?

Exploitation requires local access, low privileges, high attack complexity, and user interaction. The issue is tied to a failed GSSAPIAuthentication attempt in sshd.

Q: Which confidentiality, integrity, and availability impacts are indicated?

The supplied severity vector indicates low confidentiality impact, with no integrity or availability impact.

Q: What versions should be updated?

OpenSSH versions before 10.6 are affected according to the available information. Updating to OpenSSH 10.6 or later addresses the affected version range.

Published Oct 6, 2026

Updated

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

Affected Software

6 affected componentsFixes available

OpenSSH OpenSSH<10.6

OpenBSD OpenSSH<10.6

debian/openssh<=1:9.2p1-2+deb12u10, <=1:9.2p1-2+deb12u9, <=1:10.0p1-7+deb13u4, <=1:10.0p1-7+deb13u2

1:10.6p1-1

debian/openssh-gssapi

1:10.6p1-1

All of the following

azurelinux/openssh<9.8p1-11

9.8p1-11

Microsoft Azure Linux=3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/openssh to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade debian/openssh-gssapi to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade azurelinux/openssh to a version that resolves this vulnerability.
Fixed in 9.8p1-11
Upgrade
Upgrade OpenSSH to a version that resolves this vulnerability.
Fixed in 10.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:25 PM

Data Sourced

via MITRE·08:25 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeaknessAffected Software

Oct 8, 2026

Data Sourced

via Microsoft·08:14 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What access and conditions are required to exploit this issue?

Exploitation requires local access, low privileges, high attack complexity, and user interaction. The issue is tied to a failed GSSAPIAuthentication attempt in sshd.

Which confidentiality, integrity, and availability impacts are indicated?

The supplied severity vector indicates low confidentiality impact, with no integrity or availability impact.

What versions should be updated?

OpenSSH versions before 10.6 are affected according to the available information. Updating to OpenSSH 10.6 or later addresses the affected version range.

CVE-2026-106553: High severity OpenSSH OpenSSH vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and conditions are required to exploit this issue?

Which confidentiality, integrity, and availability impacts are indicated?

What versions should be updated?

Company

Resources

Contact