CVE-2026-59851

Опубликовано: 21 июл. 2026

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Ссылки

https://access.redhat.com/errata/RHSA-2026:42922
Issue Tracking
https://access.redhat.com/errata/RHSA-2026:55855
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-59851
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2498184
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x86:*

cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x86:*

cpe:2.3:o:redhat:enterprise_linux_eus:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:10.2:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*

EPSS

Процентиль: 42%

0.00489

Низкий

8.8 High

CVSS3

Дефекты

CWE-863

Связанные уязвимости

CVE-2026-59851

CVSS3: 8.8

ubuntu

4 месяца назад

CVE-2026-59851

CVSS3: 8.8

redhat

4 месяца назад

CVE-2026-59851

CVSS3: 8.8

debian

4 месяца назад

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, ...

ROS-20260907-80-0016

CVSS3: 8.8

redos

2 месяца назад

Уязвимость libssh

ROS-20260907-73-0016

CVSS3: 8.8

redos

2 месяца назад

Уязвимость libssh

EPSS

Процентиль: 42%

0.00489

Низкий

8.8 High

CVSS3

Дефекты

CWE-863