Improper access control in libssh - CVE-2026-59851
Published: July 27, 2026
Vulnerability identifier: #VU139523
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59851
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to impersonate any local user on the server.
The vulnerability exists due to improper access control in the libssh server gssapi-keyex authentication handling when processing gssapi-keyex authentication requests. A remote user can authenticate with valid Kerberos credentials and request an arbitrary username to impersonate any local user on the server.
Only SSH servers built on libssh with GSSAPIKeyExchange enabled are vulnerable.
Affected software
libssh
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
libssh (Red Hat package)
Netezza Appliance - Cyclops
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
libssh (Red Hat package)
Netezza Appliance - Cyclops
How to mitigate CVE-2026-59851
Install security update from vendor's website.
libssh - update to 0.12.1
libssh (Red Hat package) - update to 0.12.0-3.el10_2
Netezza Appliance - Cyclops - update to 11.3.1.4
libssh (Red Hat package) - update to 0.12.0-3.el10_2
Netezza Appliance - Cyclops - update to 11.3.1.4