PT-2026-61950 · Red Hat · Red Hat Enterprise Linux 10+3

CVE-2026-59851 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-59851

Affected Products

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Red Hat Hardened Images

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-59851 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-59851 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2498184 · Note