PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59851 Red Hat CVE debrief

CVE-2026-59851 is a HIGH severity vulnerability in libssh that allows authenticated clients to log in as arbitrary users. The flaw is found in the gssapi-keyex path when GSSAPIKeyExchange is enabled, and it does not verify whether the authenticated Kerberos principal is authorized for the requested local user. This vulnerability has significant implications for system administrators and security teams responsible for libssh servers, particularly those with GSSAPIKeyExchange enabled.

Vendor
Red Hat
Product
Red Hat Hardened Images
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

System administrators and security teams responsible for libssh servers, particularly those with GSSAPIKeyExchange enabled, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes reviewing and updating their current security measures, monitoring for potential exploits, and implementing additional security controls as needed.

Technical summary

The vulnerability is caused by the lack of verification of the authenticated Kerberos principal's authorization for the requested local user in the gssapi-keyex path of libssh. This allows authenticated clients to log in as arbitrary users, potentially leading to unauthorized access and malicious activities. The affected product is libssh, and the vulnerability is related to the gssapi-keyex path when GSSAPIKeyExchange is enabled.

Defensive priority

High priority should be given to patching libssh servers with GSSAPIKeyExchange enabled, as this vulnerability allows for unauthorized access. System administrators and security teams should also review and update their current security measures, monitor for potential exploits, and implement additional security controls as needed.

Recommended defensive actions

  • Apply the patch or update libssh to a version that fixes this vulnerability
  • Disable GSSAPIKeyExchange if not required
  • Monitor and restrict access to libssh servers
  • Implement additional security measures, such as multi-factor authentication
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T15:16:37.897Z and was last modified on 2026-07-22T20:17:04.877Z. The NVD entry is currently Undergoing Analysis. This information is based on the provided source corpus and may not reflect the current status. Further verification is recommended.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T15:16:37.897Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.