CVE-2026-110924

MEDIUMCVSS 4.8

Description

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state.

Timeline

Published:October 15th, 2026 2:17 PM

Last modified:October 15th, 2026 5:17 PM

CVSS Scoring

CVSS v3: 4.8 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-459

References & Reports

Advisories, patches, and third-party reports

https://access.redhat.com/security/cve/CVE-2026-110924
https://bugzilla.redhat.com/show_bug.cgi?id=2553033

Source: NIST NVD · Data may lag official sources by up to one minute