CVE-2005-2798: OpenBSD OpenSSH

Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days.

sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.

Affected products

• OpenBSD OpenSSH: version 3.0 only; version 3.0.1 only; version 3.0.1p1 only; version 3.0.2 only; version 3.0.2p1 only; version 3.0p1 only; …

Published 2005-09-06. Last modified 2026-06-16.