CVE-2026-106555

A flaw was found in OpenSSH's SSH daemon (sshd). When Generic Security Service Application Program Interface (GSSAPI) authentication is enabled, authentication state can improperly persist across separate authentication attempts. A local user could exploit this condition during sequential authentication sessions to access residual credentials from prior attempts, resulting in an information disclosure.

This vulnerability is rated as Low impact because exploitation is constrained to systems where GSSAPI authentication is explicitly enabled and yields only limited residual credential data rather than unauthorized access or privilege escalation. The condition requires a specific sequence of an initial failed GSSAPI negotiation followed by a successful secondary authentication method within the same connection. In standard deployments where GSSAPI is disabled or not used in conjunction with fallback authentication methods, the vulnerability cannot be triggered.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable GSSAPI authentication in the SSH daemon configuration if Kerberos-based authentication is not required.