Libssh < 0.11.5 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/libssh--0.11.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 21 Jul 2026 15:21:32 +0000CVE-2026-59851: Libssh GSSAPIKeyExchange Authorization Bypasshttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-59851-libssh-gssapikeyexchange-bypass/Tue, 21 Jul 2026 15:21:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-59851-libssh-gssapikeyexchange-bypass/A vulnerability in libssh, tracked as CVE-2026-59851, allows an authenticated Kerberos principal to bypass authorization checks on servers with GSSAPIKeyExchange enabled, enabling arbitrary local user login and potential privilege escalation.CVE-2026-59851 describes a critical authorization bypass vulnerability within the libssh library when configured on servers with GSSAPIKeyExchange enabled. This flaw resides specifically in the gssapi-keyex path, where the library fails to properly verify if an already authenticated Kerberos principal is authorized to log in as the requested local user. This allows an attacker, who has successfully authenticated via Kerberos, to potentially assume the identity of any arbitrary local user on the system, including privileged accounts, leading to unauthorized access and privilege escalation. While no specific threat actor or active exploitation campaigns have been detailed in the NVD source, the high CVSS score of 8.8 indicates a severe risk. Defenders should prioritize patching and configuration review to mitigate this risk, as successful exploitation could grant full control over affected systems.

Attack Chain

  1. An attacker obtains valid Kerberos credentials for an account within the target network environment.
  2. The attacker initiates an SSH connection to a server running a vulnerable version of libssh with GSSAPIKeyExchange explicitly enabled.
  3. During the SSH authentication process, the attacker leverages their Kerberos credentials via the GSSAPIKeyExchange mechanism.
  4. The vulnerable libssh server's gssapi-keyex path processes the Kerberos authentication request.
  5. Due to the flaw (CVE-2026-59851), the server incorrectly maps the authenticated Kerberos principal to an arbitrary local user specified by the attacker, bypassing proper authorization checks.
  6. The libssh server grants the attacker a session as the chosen arbitrary local user, potentially leading to privilege escalation if a privileged user (e.g., root) is targeted.

Impact

Successful exploitation of CVE-2026-59851 allows an authenticated attacker to bypass intended authorization mechanisms and log in as any local user on the compromised server. This can lead to severe consequences, including unauthorized access to sensitive data, modification or deletion of system files, and complete system compromise, particularly if the attacker gains access as an administrative user. Organizations using libssh with GSSAPIKeyExchange enabled in environments with Kerberos authentication are at risk, and the impact could range from data exfiltration to total disruption of services.

Recommendation

  • Patch CVE-2026-59851 by updating all libssh installations to a fixed version immediately.
  • If immediate patching is not feasible, review system configurations and disable GSSAPIKeyExchange on libssh servers unless absolutely necessary.
  • Implement robust monitoring of authentication logs for unusual login attempts or successful logins by Kerberos principals mapped to unexpected local user accounts, leveraging available log sources.
]]>highthreatvulnerabilityauthorization-bypassprivilege-escalationlibssh