CVE-2026-59851 in Red Hat
Summary
by MITRE • 07/21/2026
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists within the libssh library where servers configured with GSSAPIKeyExchange enabled fail to properly validate Kerberos principal authorization for local user accounts during the gssapi-keyex authentication process. The flaw stems from insufficient access control validation that occurs when clients successfully authenticate through Kerberos but are subsequently granted access to arbitrary local user accounts without proper verification of their privileges. This represents a critical authorization bypass vulnerability that directly violates the principle of least privilege and could enable unauthorized users to escalate their access to sensitive system resources.
The technical implementation flaw occurs in the GSSAPI key exchange mechanism where the library accepts valid Kerberos authentication tokens but fails to cross-reference these credentials against local user account permissions or mappings. This allows any authenticated Kerberos user to potentially assume the identity of any local user account on the system, effectively creating a privilege escalation vector. The vulnerability specifically affects systems where GSSAPIKeyExchange is enabled in the sshd configuration, making it exploitable when clients connect using GSSAPI authentication methods. According to CWE-284, this represents an improper access control weakness that permits unauthorized access to resources through inadequate authorization checks.
The operational impact of this vulnerability is severe as it enables authenticated attackers to gain access to arbitrary user accounts without requiring additional credentials or knowledge of local user passwords. An attacker who can establish a GSSAPI connection to the affected sshd service could potentially escalate privileges to gain administrative access to system resources, access sensitive data, or compromise other user accounts on the system. This vulnerability affects organizations that rely on Kerberos authentication for their SSH infrastructure and could lead to significant security breaches if exploited. The issue aligns with ATT&CK technique T1078 which covers legitimate credentials usage and privilege escalation through authorized access.
Mitigation strategies should include disabling GSSAPIKeyExchange in sshd configuration when not explicitly required, implementing proper Kerberos principal-to-local-user mapping controls, and ensuring that all systems have up-to-date libssh versions that address this vulnerability. Organizations should also conduct thorough audits of their SSH configurations to identify systems with GSSAPIKeyExchange enabled and implement additional monitoring for suspicious authentication patterns. Regular security assessments and patch management processes should be enforced to prevent exploitation of similar authorization bypass vulnerabilities in other cryptographic libraries or authentication mechanisms.