CVE-2026-106553

A flaw was found in OpenSSH. When Generic Security Services Application Programming Interface (GSSAPI) authentication is enabled, the SSH daemon fails to properly discard credentials after a failed authentication attempt. If a user subsequently authenticates through another method, the leftover credentials can persist and become inappropriately accessible to that session. This issue allows an authenticated user to access lingering credentials, leading to information disclosure.

A flaw was found in OpenSSH where the sshd daemon fails to properly discard GSSAPI credentials after a failed authentication attempt when GSSAPIAuthentication is enabled. If a user subsequently authenticates through another method, the leftover credentials can persist and become inappropriately accessible to that session, allowing an authenticated local user to access lingering GSSAPI credentials and causing information disclosure. This affects the openssh package in Red Hat Hardened Images, where a fix is being pursued. Exploitation requires GSSAPI authentication to be enabled (it is disabled by default), a failed GSSAPI authentication attempt, and a subsequent successful authentication through another method; the impact is limited to confidentiality of the residual credentials, with no integrity or availability impact. Red Hat therefore rates this flaw LOW severity (CVSS 3.1 score 2.2), which differs significantly from the NIST score of 7.5: the NIST vector assumes a network-accessible, unauthenticated attack with high integrity impact, which is not supported by the technical evidence for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Set GSSAPIAuthentication to no in the sshd configuration (e.g. /etc/ssh/sshd_config) and reload or restart the sshd service. This flaw only occurs when GSSAPI authentication is enabled, which is not the default configuration, so deployments that do not rely on GSSAPI authentication can disable it to prevent credentials from persisting after a failed authentication attempt. The upstream fix is included in OpenSSH 10.6; for the affected Red Hat Hardened Images package, apply the update once it becomes available through the product's update stream.