CVE-2026-55655: OpenBSD OpenSSH Information Disclosure Flaw

CVE-2026-55655 Overview

CVE-2026-55655 is a flaw in OpenSSH that allows a local unprivileged attacker on a Linux client host to hijack client-side X11 forwarding connections. The attack works by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attacker can intercept forwarded X11 traffic, including window contents and keyboard input. The flaw also permits limited manipulation of the forwarded session. The issue affects OpenSSH and shipped versions in Red Hat Enterprise Linux 6 through 10. The vulnerability is categorized under [CWE-923] (Improper Restriction of Communication Channel to Intended Endpoints).

Critical Impact
A local unprivileged user on the SSH client host can silently intercept forwarded X11 sessions, exposing keystrokes, window contents, and other sensitive GUI data.

Affected Products

OpenBSD OpenSSH (upstream)
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Linux distributions packaging vulnerable OpenSSH builds with X11 forwarding enabled

Discovery Timeline

2026-06-23 - CVE-2026-55655 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-55655

Vulnerability Analysis

The flaw exists in the X11 forwarding path of the OpenSSH client (ssh). When a user connects with -X or -Y, the client allocates a local display endpoint and proxies X protocol traffic through the SSH channel. On Linux, OpenSSH prefers an abstract UNIX-domain socket for the forwarded display rather than a TCP socket on localhost:60xx. Abstract sockets live in the Linux network namespace and are not protected by filesystem permissions. Any local process in the same namespace can attempt to bind() an abstract name. A local unprivileged attacker can pre-bind the abstract socket name OpenSSH expects to use before the client claims it.

Root Cause

The root cause is the trust placed in abstract UNIX-domain socket names that are not subject to filesystem access control. OpenSSH assumes the preferred abstract X socket name will be uniquely owned by the client process, but the Linux abstract namespace allows any local user to race for and occupy that name. This pattern aligns with [CWE-923], where a communication endpoint is not properly restricted to the intended party.

Attack Vector

The attack requires local access to the SSH client host and user interaction in the form of an SSH session initiated with X11 forwarding. An unprivileged attacker runs a process that binds the predictable abstract socket name before the legitimate ssh client. When the forwarded application connects to the display, it reaches the attacker's socket. The attacker can then proxy traffic to the real X server while logging keystrokes and screen contents, or inject events into the session. Exploitation does not require elevated privileges and leaves few obvious indicators in standard logs.

No public proof-of-concept is listed in the references, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. See the Red Hat CVE-2026-55655 Advisory for vendor technical details.

Detection Methods for CVE-2026-55655

Indicators of Compromise

Unexpected processes calling bind() on abstract UNIX sockets matching the X11 display pattern (for example @/tmp/.X11-unix/X10 and higher numbered displays used by SSH forwarding).
Multiple processes owned by non-root users listening on abstract sockets in the .X11-unix namespace concurrently with an active ssh -X session.
Local user processes spawned shortly before a forwarded X11 application starts, with no legitimate parent in the user's GUI session.

Detection Strategies

Audit abstract socket bindings using ss -xlp and correlate listening processes against the expected ssh client PID for the active X11 forwarded session.
Use Linux audit rules (auditctl) to record bind syscalls on AF_UNIX sockets and alert when non-ssh processes claim X display names.
Hunt for processes that open /tmp/.X11-unix/ paths or abstract equivalents without belonging to the X server, display manager, or ssh client process tree.

Monitoring Recommendations

Centralize host telemetry covering process creation, parent-child relationships, and UNIX socket activity on multi-user Linux systems.
Monitor for ssh invocations with -X, -Y, or ForwardX11 yes on hosts where local users without administrative trust have shell access.
Track configuration drift in /etc/ssh/ssh_config and per-user ~/.ssh/config to detect re-enablement of X11 forwarding after policy hardening.

How to Mitigate CVE-2026-55655

Immediate Actions Required

Disable X11 forwarding on client hosts that have untrusted local users by setting ForwardX11 no in /etc/ssh/ssh_config and removing -X and -Y from operational runbooks.
Apply vendor updates for OpenSSH as soon as packages are available from your Linux distribution; track the Red Hat Bugzilla Report #2462250 for RHEL fix status.
Inventory hosts where users routinely connect with X11 forwarding and prioritize patching shared bastion and developer workstations first.

Patch Information

Red Hat tracks the fix through the Red Hat CVE-2026-55655 Advisory and Red Hat Bugzilla Report #2462250. Apply the OpenSSH update published by your distribution. Rebuild or restart any long-running ssh sessions after patching so that new connections use the fixed client binary.

Workarounds

Use TCP-based X11 forwarding by setting ForwardX11Trusted no together with distribution options that force a TCP localhost display instead of an abstract UNIX socket, where supported.
Tunnel GUI applications over alternative protocols such as VNC or RDP inside an SSH tunnel, avoiding X11 forwarding entirely on shared hosts.
Restrict shell access on client hosts so that only trusted users can run local processes during X11 forwarded sessions.

bash

# Disable X11 forwarding system-wide on the SSH client host
sudo sed -i 's/^[# ]*ForwardX11.*/ForwardX11 no/' /etc/ssh/ssh_config
grep -E '^ForwardX11' /etc/ssh/ssh_config

# Verify no stray processes hold abstract X display sockets
ss -xlp | grep -E '@?/tmp/\.X11-unix|@/X11'