CVE-2026-59847: libssh AES-GCM Integrity Bypass Flaw

CVE-2026-59847 Overview

CVE-2026-59847 is a cryptographic flaw in libssh builds that use the OpenSSL backend. Incorrect AES-GCM finalization checks effectively remove integrity protection from the SSH transport layer. An in-path attacker can modify plaintext traffic on the wire without detection by either endpoint. The weakness is classified under [CWE-1310] (Missing Ability to Patch ROM Code / cryptographic integrity issues) and affects the confidentiality guarantees that SSH users expect from AES-GCM cipher suites. Red Hat has issued advisory RHSA-2026:42922 covering this issue.

Critical Impact
An in-path attacker can tamper with SSH session plaintext undetected when libssh negotiates AES-GCM using the OpenSSL backend, breaking the integrity guarantee of the SSH transport.

Affected Products

libssh builds compiled against the OpenSSL cryptographic backend
Red Hat Enterprise Linux packages referenced in RHSA-2026:42922
Applications and services that link libssh for SSH client or server functionality

Discovery Timeline

2026-07-21 - CVE CVE-2026-59847 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59847

Vulnerability Analysis

The flaw resides in the AES-GCM cipher finalization path within libssh when the library is built against OpenSSL. AES-GCM is an authenticated encryption mode that produces both a ciphertext and an authentication tag. Correct operation requires the receiver to verify the tag before accepting the plaintext. In affected builds, the finalization logic does not properly enforce this verification. As a result, tampered ciphertext can be decrypted and delivered to the SSH state machine as if it were authentic.

Exploitation requires an attacker positioned in the network path between client and server. The attack complexity is high because the adversary must manipulate live traffic during an active SSH session that negotiated an AES-GCM cipher. Successful tampering compromises integrity of SSH channel data, including shell input, forwarded ports, and file transfers.

Root Cause

The root cause is an incorrect return-value or state check during the OpenSSL EVP finalization step for AES-GCM. The code path fails to treat authentication tag mismatches as fatal, allowing forged or modified frames to pass validation. This defeats the Encrypt-then-MAC-equivalent guarantee that AEAD ciphers provide.

Attack Vector

The attack vector is network-based and requires an active in-path adversary such as a rogue router, compromised gateway, or hijacked BGP route. The attacker intercepts SSH frames, modifies the ciphertext, and forwards the tampered stream. Because the integrity check is broken, neither peer detects the modification. No authentication or user interaction on either endpoint is required. Confidentiality of the session key is not directly compromised, but session integrity is.

No verified public exploit code is available. Refer to the Red Hat CVE-2026-59847 Details and Red Hat Bug Report #2498180 for technical context.

Detection Methods for CVE-2026-59847

Indicators of Compromise

Unexpected SSH session disconnects or protocol errors following network path changes, which can indicate tampering attempts that trigger downstream parsing faults.
SSH sessions negotiating AES-GCM cipher suites (aes128-gcm@openssh.com, aes256-gcm@openssh.com) originating from hosts running vulnerable libssh versions.
Anomalous command execution or file transfers within authenticated SSH sessions that do not match user behavioral baselines.

Detection Strategies

Inventory all hosts and container images that ship libssh linked against OpenSSL, using package managers such as rpm -q libssh or dpkg -l libssh.
Correlate SSH server and client logs with network flow data to identify sessions traversing untrusted network segments.
Deploy TLS/SSH-aware network monitoring to flag unexpected middleboxes or route changes between SSH peers.

Monitoring Recommendations

Enable verbose SSH transport logging on both clients and servers to capture cipher negotiation and MAC failures.
Alert on repeated SSH rekey events or abnormal disconnect codes that may indicate active tampering attempts.
Monitor for new or unauthorized libssh-linked binaries appearing on endpoints and servers.

How to Mitigate CVE-2026-59847

Immediate Actions Required

Apply the updated libssh packages from your distribution vendor, prioritizing hosts referenced in Red Hat Security Advisory RHSA-2026:42922.
Restart all services that dynamically load libssh after patching to ensure the fixed library is in use.
Rebuild and redeploy statically linked binaries and container images that embed libssh.

Patch Information

Red Hat has released fixed packages through RHSA-2026:42922. Consult your Linux distribution's security tracker for the specific libssh version that includes the corrected AES-GCM finalization check. Verify installed versions with ldd against affected binaries and validate that they resolve to the patched library path.

Workarounds

Configure SSH clients and servers to prefer non-AES-GCM cipher suites such as chacha20-poly1305@openssh.com until patches are applied.
Restrict SSH traffic to trusted network paths using VPN tunnels or IPsec to reduce in-path attacker exposure.
Enforce strict host key verification and certificate-based authentication to detect broader man-in-the-middle activity.

bash

# Example: prefer non-GCM ciphers in /etc/ssh/ssh_config
Ciphers chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

# Verify installed libssh version on RHEL-based systems
rpm -q libssh

# Identify processes using libssh after patching
lsof 2>/dev/null | grep libssh