CVE-2026-59998

A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using GSSAPI authentication for sshd when the server is integrated with a Windows Active Directory environment. If GSSAPI authentication is not strictly required, it can be disabled by setting GSSAPIAuthentication no in the /etc/ssh/sshd_config file. After modifying the configuration, the sshd service must be restarted for the changes to take effect. Note that restarting the sshd service will terminate all active SSH sessions.

# echo "GSSAPIAuthentication no" >> /etc/ssh/sshd_config
# systemctl restart sshd

Alternatively, if GSSAPI authentication is necessary in such an environment, ensure that the network path between the client and the sshd server, and to the Active Directory, is secured and trusted to prevent man-in-the-middle attacks.