CVE-2026-60000 Overview
CVE-2026-60000 affects sshd in OpenSSH versions before 10.4. The vulnerability allows remote attackers to cause a denial of service through resource consumption. The root cause is improper handling of the MaxAuthTries limit when GSSAPIAuthentication is enabled. Attackers can submit excessive authentication attempts that bypass the intended cap, consuming server resources. The issue is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling).
Critical Impact
Remote unauthenticated attackers can exhaust sshd resources through repeated GSSAPI authentication attempts, degrading SSH service availability on affected hosts.
Affected Products
- OpenSSH sshd versions prior to 10.4
- Systems with GSSAPIAuthentication enabled in sshd_config
- Linux and Unix distributions bundling vulnerable OpenSSH builds
Discovery Timeline
- 2026-07-08 - CVE-2026-60000 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-60000
Vulnerability Analysis
The flaw resides in the authentication loop of sshd when Generic Security Services Application Program Interface (GSSAPI) authentication is negotiated. OpenSSH enforces a per-connection cap on authentication attempts through the MaxAuthTries directive. For GSSAPI authentication, this counter was mishandled, allowing a client to submit authentication requests beyond the configured limit. Each attempt consumes CPU cycles, memory, and cryptographic context state on the server. Repeated concurrent sessions from a single attacker amplify the impact against the SSH daemon.
Root Cause
The defect maps to [CWE-770], Allocation of Resources Without Limits or Throttling. The GSSAPI authentication code path did not consistently increment or evaluate the MaxAuthTries counter. As a result, the throttling mechanism intended to bound authentication work per connection was bypassed for this specific method. The fix landed in OpenSSH 10.4p1, as documented in the OpenSSH Release Notes 10.4p1.
Attack Vector
Exploitation requires network access to the SSH listening port, typically TCP/22. The attacker does not need valid credentials or user interaction. The attacker opens SSH sessions, negotiates GSSAPI authentication, and issues repeated authentication attempts within each session. Because the counter is mishandled, the server continues processing attempts beyond MaxAuthTries, consuming server-side resources. The vulnerability is only exploitable where administrators have enabled GSSAPIAuthentication yes, commonly seen in Kerberos-integrated environments. Additional technical context is available on the OpenSSH Development Mailing List and the Openwall OSS Security Discussion.
Detection Methods for CVE-2026-60000
Indicators of Compromise
- Repeated sshd log entries showing multiple GSSAPI authentication attempts from a single source within one session
- Elevated sshd process counts, CPU utilization, or memory pressure on hosts exposing SSH
- Sudden spikes in inbound TCP/22 connections correlated with GSSAPI negotiation traffic
Detection Strategies
- Parse auth.log or journald for sshd entries containing gssapi-with-mic followed by repeated Failed events beyond the configured MaxAuthTries value
- Correlate network flow data with authentication logs to identify sources generating disproportionate GSSAPI attempts
- Baseline typical GSSAPI authentication volume per source and alert on deviations
Monitoring Recommendations
- Monitor sshd resource consumption metrics including per-process CPU and RSS memory
- Track SSH connection rates and authentication failure rates per source IP
- Alert on OpenSSH versions below 10.4 discovered through asset inventory scans
How to Mitigate CVE-2026-60000
Immediate Actions Required
- Upgrade sshd to OpenSSH 10.4 or later on all internet-facing and internal hosts
- Audit sshd_config for GSSAPIAuthentication yes and disable it where Kerberos authentication is not required
- Restrict SSH exposure using firewall rules, bastion hosts, or network access control lists
Patch Information
OpenSSH 10.4p1 resolves the MaxAuthTries handling for GSSAPI authentication. Consult the OpenSSH Release Notes 10.4p1 for build and packaging details. Distribution maintainers ship backported fixes through standard channels; apply vendor updates as they become available.
Workarounds
- Set GSSAPIAuthentication no in sshd_config if GSSAPI is not required, then reload sshd
- Lower MaxStartups and LoginGraceTime to constrain concurrent unauthenticated sessions
- Apply rate limiting or connection throttling at the network layer for TCP/22
# Configuration example: disable GSSAPI and tighten connection limits
# /etc/ssh/sshd_config
GSSAPIAuthentication no
MaxAuthTries 3
MaxStartups 10:30:60
LoginGraceTime 30
# Apply changes
sudo sshd -t && sudo systemctl reload sshd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
