CVE-2026-106555: OpenSSH Authentication Bypass Vulnerability

CVE-2026-106555 Overview

CVE-2026-106555 affects sshd in OpenSSH versions prior to 10.6. The flaw stems from incorrect handling of Generic Security Services Application Program Interface (GSSAPI) authentication state, which can persist across authentication attempts. This improper separation of state between distinct authentication sessions is categorized under [CWE-669] Incorrect Resource Transfer Between Spheres. The issue requires local access with existing low privileges, high attack complexity, and user interaction to exploit, limiting its practical risk to narrow scenarios.

Critical Impact
Residual GSSAPI authentication state in sshd can leak limited confidentiality-impacting information across authentication attempts under local, high-complexity conditions.

Affected Products

OpenSSH sshd versions prior to 10.6
Deployments with GSSAPIAuthentication enabled in sshd_config
Systems integrating OpenSSH with Kerberos or other GSSAPI mechanisms

Discovery Timeline

2026-10-06 - CVE-2026-106555 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-106555

Vulnerability Analysis

The vulnerability resides in how sshd manages GSSAPI authentication state between successive authentication attempts within the same connection. OpenSSH supports multi-step authentication, allowing a client to try several methods or retries. GSSAPI authentication relies on security contexts negotiated through mechanisms such as Kerberos. These contexts should be fully torn down and reinitialized between attempts.

In versions before 10.6, residual GSSAPI state can carry over into subsequent attempts. An attempt that should start from a clean slate may instead inherit context data established during a prior exchange. This violates the principle of session isolation during authentication and introduces a predictable state leak between spheres of authority.

Root Cause

The root cause is incorrect lifecycle management of GSSAPI authentication state inside sshd. The server fails to reset or discard context material consistently when a new authentication attempt begins. OpenSSH 10.6 addresses the issue by ensuring GSSAPI state is bounded strictly to a single authentication attempt.

Attack Vector

Exploitation requires a local attacker with low privileges and user interaction. The attack complexity is high because the attacker must stage multiple authentication attempts in a specific order to observe or influence the retained state. Successful exploitation yields limited information disclosure. There is no integrity or availability impact, and no remote network vector. Consult the OpenSSH Release Notes 10.6 for upstream technical detail.

Detection Methods for CVE-2026-106555

Indicators of Compromise

Repeated GSSAPI authentication attempts from the same source within a single SSH connection recorded in /var/log/auth.log or journalctl -u sshd.
Unexpected successful GSSAPI authentications following prior failed attempts without a fresh ticket exchange.
Anomalous sshd debug entries referencing reused or lingering GSSAPI contexts.

Detection Strategies

Audit sshd_config across the fleet for GSSAPIAuthentication yes and inventory hosts running OpenSSH below 10.6.
Correlate SSH authentication logs with Kerberos ticket issuance events to detect sessions that authenticate without a corresponding fresh ticket grant.
Baseline normal GSSAPI authentication patterns and alert on connections producing multiple authentication attempts in short windows.

Monitoring Recommendations

Centralize sshd logs and Kerberos Key Distribution Center (KDC) logs for cross-source analysis.
Alert on repeated userauth_gssapi sequences within a single connection ID.
Track OpenSSH package versions as a continuous configuration-management metric.

How to Mitigate CVE-2026-106555

Immediate Actions Required

Upgrade OpenSSH sshd to version 10.6 or later on all affected hosts.
Disable GSSAPIAuthentication where it is not required for operational workflows.
Restrict local account access on systems exposing GSSAPI-enabled SSH services.

Patch Information

OpenSSH 10.6 contains the upstream fix that correctly scopes GSSAPI authentication state to individual authentication attempts. Distributions typically ship backported patches; verify your vendor advisory and apply the corresponding package update. See the OpenSSH Release Notes 10.6 for the authoritative change description.

Workarounds

Set GSSAPIAuthentication no in /etc/ssh/sshd_config on hosts that do not require Kerberos-based SSH login.
Limit AllowUsers and AllowGroups directives to reduce the population of accounts able to initiate GSSAPI authentication.
Enforce MaxAuthTries 1 where feasible to minimize retry-based exploitation windows.

bash

# Configuration example: disable GSSAPI authentication and reload sshd
sudo sed -i 's/^#*GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl reload sshd