CVE-2026-59851: Libssh: libssh: authentication bypass via missing gssapi principal check
A flaw was found in libssh server-side GSSAPIKeyExchange authorization. In sshpacketuserauthrequest() in src/messages.c, the gssapi-keyex login path granted success after Kerberos authentication without dispatching the callback that verifies whether the authenticated principal is authorized for the requested local user. On servers with GSSAPIKeyExchange enabled, an authenticated client can therefore log in as an arbitrary local user if the missing principal-to-user authorization check is relied upon for access control.
Other sources
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59851?
CVE-2026-59851 has a high severity rating of 8.8.
What does CVE-2026-59851 affect?
CVE-2026-59851 affects the libssh library and the libssh server-side GSSAPIKeyExchange authorization.
How do I fix CVE-2026-59851?
To fix CVE-2026-59851, update to the latest version of libssh that addresses the authentication bypass issue.
What is the risk associated with CVE-2026-59851?
The risk associated with CVE-2026-59851 is 83, indicating a significant potential security threat.
What is the impact of CVE-2026-59851?
The impact of CVE-2026-59851 includes the potential for unauthorized access due to a missing GSSAPI principal check after Kerberos authentication.