CVE-2026-106555: High severity OpenSSH OpenSSH vulnerability

Q: Which systems are in scope for this issue?

The issue affects sshd in OpenSSH versions before 10.6. It is specifically associated with GSSAPIAuthentication authentication state handling.

Q: What would an attacker need to exploit it?

The supplied vector indicates local access, low privileges, high attack complexity, and user interaction are required. The vector does not indicate that remote unauthenticated exploitation is possible.

Q: What is the expected security impact?

The reported impact is limited to low confidentiality impact. No integrity or availability impact is indicated.

Published Oct 6, 2026

Updated

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

Affected Software

4 affected componentsFixes available

OpenSSH OpenSSH<10.6

OpenBSD OpenSSH<10.6

debian/openssh<=1:9.2p1-2+deb12u10, <=1:9.2p1-2+deb12u9, <=1:10.0p1-7+deb13u4, <=1:10.0p1-7+deb13u2

1:10.6p1-1

debian/openssh-gssapi

1:10.6p1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/openssh to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade debian/openssh-gssapi to a version that resolves this vulnerability.
Fixed in 1:10.6p1-1
Upgrade
Upgrade OpenSSH to a version that resolves this vulnerability.
Fixed in 10.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:28 PM

Data Sourced

via MITRE·08:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeaknessAffected Software

Oct 8, 2026

Data Sourced

via Microsoft·08:15 AM

DescriptionSeverityWeakness

Oct 14, 2026

Data Sourced

via Launchpad·02:50 PM

Description

Data Sourced

via Debian·02:50 PM

DescriptionAffected Software

Oct 15, 2026

Data Sourced

via Ubuntu·02:50 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are in scope for this issue?

The issue affects sshd in OpenSSH versions before 10.6. It is specifically associated with GSSAPIAuthentication authentication state handling.

What would an attacker need to exploit it?

The supplied vector indicates local access, low privileges, high attack complexity, and user interaction are required. The vector does not indicate that remote unauthenticated exploitation is possible.

What is the expected security impact?

The reported impact is limited to low confidentiality impact. No integrity or availability impact is indicated.

CVE-2026-106555: High severity OpenSSH OpenSSH vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are in scope for this issue?

What would an attacker need to exploit it?

What is the expected security impact?

Company

Resources

Contact