CVE-2026-59851: Libssh

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Affected products

• Libssh Libssh: affected versions not specified
• Red Hat Enterprise Linux: version 10.0 only
• Red Hat Hardened Images: affected versions not specified

Published 2026-07-21. Last modified 2026-08-17.