CVE-2026-110924— Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OpenSSH 中发现了一个安全漏洞。当启用 GSSAPI 认证时，即使用户的授权未成功，失败的 GSSAPI 认证尝试仍可能导致已委托的凭据在连接中被保留。随后，对该连接的成功登录可能会受到残留状态的影响，从而产生授权问题。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access TokenAffected Version Matrix 9
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat Hardened Images | any |
unaffected |
any |
affected | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110924
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-110924
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110924
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-110924 (2)
-
-
2553033 – (CVE-2026-110924) CVE-2026-110924 openssh: openssh: GSSAPI delegated credentials can be stored after a failed authentication issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-15 · 9 CVEs total
| CVE-2026-85634 | 8.8 HIGH | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in |
| CVE-2026-92982 | 8.5 HIGH | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 te |
| CVE-2026-108334 | 7.4 HIGH | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-ope |
| CVE-2026-110923 | 6.5 MEDIUM | Openssh: openssh: sftp can write outside the destination directory from a server-supplied |
| CVE-2026-109131 | 5.4 MEDIUM | Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection modu |
| CVE-2026-110925 | 5.4 MEDIUM | Openssh: openssh: '$' and '\' in a command-line username expand through %u |
| CVE-2026-110926 | 5.3 MEDIUM | Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels |
| CVE-2026-110927 | 4.3 MEDIUM | Openssh: openssh: a compressed payload can expand past the maximum packet size |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-109968
Clevis: clevis: pkcs#11 luks passphrase logged in plaintext -
CVE-2026-100229
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: ou -
CVE-2026-109971
Clevis: clevis: pkcs#11 token pin exposed on command line vi -
CVE-2026-109970
Clevis: clevis: pkcs#11 token pin written to world-readable -
CVE-2026-109969
Clevis: clevis: no authentication on pkcs#11 af_unix sockets
Same vendor: Red Hat
-
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url -
CVE-2026-108334
Github.com/kuadrant/kuadrant-operator/internal/wasm: github. -
CVE-2026-85634
Wildfly-core: wildfly-core: deployer rbac role privilege esc -
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrar -
CVE-2026-110927
Openssh: openssh: a compressed payload can expand past the m
Same weakness: CWE-459
-
CVE-2026-17525
My Control System 26.5 – Disk space exhaustion due to incorr -
CVE-2026-102030
Junos OS and Junos OS Evolved: An attacker causes routing-da -
CVE-2026-103937
Misskey: Denial of service resulting from insufficient clean -
CVE-2026-109276
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Tempora -
CVE-2026-108982
macOS VeraCrypt 1.26.29 FUSE-T构建版本残留访问漏洞
V. Comments for CVE-2026-110924
No comments yet