CVE-2026-59851 @ Saiph

"CVE-2026-59851"
"libssh-gcrypt-4-0.8.7-1+deb10u2)"
"libssh-gcrypt-4"
"libssh"
"Am I vulnerable?"

Status

not_applicable

Priority

1.16

Match score

3.0

Risk

MemCorrupt Remote priv:user

CVSS

8.8 HIGH

Reason

cpe: libssh; pkgs: libssh-gcrypt-4; version: unknown (libssh-gcrypt-4-0.8.7-1+deb10u2); risk:memory_corruption

Created

2026-08-03T20:47:09Z

Updated

2026-08-22T10:15:45Z

Closed

2026-08-04T00:55:38Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
libssh-gcrypt-4-0.8.7-1+deb10u2)
libssh-gcrypt-4
libssh

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: libssh-gcrypt · libssh · libssh-gcrypt-4

System	Matches	Ticket for CVE-2026-59851
Saiph	libssh-gcrypt-4 0.8.7-1+deb10u2; libssh2-1 1.8.0-2.1+deb10u1	not_applicable open
Archive	libssh2-1 1.8.0-2.1+deb10u1	none
Bullseye	libssh2-1 1.9.0-2+deb11u1	none
Helios	libssh2-1 1.9.0-2+deb11u1	none
Janus	libssh2-1 1.8.0-2.1+deb10u1	none
Library	libssh2-1 1.7.0-1+deb9u2	none
Matrix	libssh2-1 1.10.0-3+b1	none
Silk	alt-libssh2 1.11.1-1.6; libssh2-1 1.10.0-3+b1	none
morris	alt-libssh2 1.8.0; alt-libssh211 1.11.1; libssh2 1.8.0; libssh2-devel 1.8.0	none
mufasa	alt-libssh2 1.8.0; alt-libssh211 1.11.1; libssh2 1.8.0	none

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2026-66032	8.8	Helios, morris, mufasa	accepted_risk	libssh	—
CVE-2026-0966	8.2	Saiph	new	libssh-gcrypt	—
CVE-2026-66033	7.5	Helios, morris, mufasa	accepted_risk	libssh	—
CVE-2026-66034	7.5	Helios, morris, mufasa	accepted_risk, not_applicable	libssh	→ CVE-2026-66033
CVE-2026-66035	7.5	morris, mufasa	not_applicable	libssh	→ CVE-2026-66033
CVE-2025-5318	5.4	Saiph	accepted_risk	libssh-gcrypt	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 4.19.0-27-amd64

kernel_version

uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

Determination

Issue: Incorrect authorization in libssh when using GSSAPIKeyExchange.
Cause: On servers with GSSAPIKeyExchange enabled, the gssapi-keyex authentication path does not properly check whether the authenticated Kerberos principal is authorized for the requested local user.
Impact: An authenticated client can log in as arbitrary local users.
CVSS: 8.8 (High)
mitigation : # In sshd_config (or the libssh server configuration) 
GSSAPIKeyExchange no
GSSAPIAuthentication no

Update status

Add note only

Mitigation log

2026-08-04T00:50:03Z — affects

Issue: Incorrect authorization in libssh when using GSSAPIKeyExchange. Cause: On servers with GSSAPIKeyExchange enabled, the gssapi-keyex authentication path does not properly check whether the authenticated Kerberos principal is authorized for the requested local user. Impact: An authenticated client can log in as arbitrary local users. CVSS: 8.8 (High)

2026-08-04T00:55:38Z — not_applicable

mitigation : # In sshd_config (or the libssh server configuration) GSSAPIKeyExchange no GSSAPIAuthentication no

References

NVD: CVE-2026-59851