CVE-2026-59998: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-59998 is an authentication bypass vulnerability in OpenSSH's sshd daemon affecting all versions before 10.4. The flaw stems from undocumented behavior where the GSSAPIStrictAcceptorCheck option has no effect when the SSH server is joined to a Windows Active Directory domain, potentially allowing unauthorized access via GSSAPI authentication. It was reported by Yarin Aharoni of Safebreach and publicly disclosed on July 6–8, 2026, alongside the OpenSSH 10.4 release. The CVSS v3.1 base score is 6.5 (Medium/High) per NVD, or 4.8 (Moderate) per the GitHub Advisory Database (GitHub Advisory, Openwall, Red Hat Bugzilla).

The root cause is classified under CWE-573 (Improper Following of Specification by Caller) and CWE-909 (Missing Initialization of Resource). The GSSAPIStrictAcceptorCheck directive is intended to enforce that GSSAPI authentication only succeeds when the server's Kerberos principal exactly matches the target host, preventing cross-host ticket acceptance. However, when the OpenSSH server is joined to a Windows Active Directory environment, this check is silently rendered ineffective — the option has no value and the validation is not performed. An unauthenticated network attacker can exploit this by presenting a valid GSSAPI/Kerberos ticket for a different host or service principal, bypassing the acceptor check and gaining unauthorized access without requiring any privileges or user interaction (Openwall, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass GSSAPI-based authentication controls on OpenSSH servers integrated with Windows Active Directory, potentially gaining unauthorized shell access to the affected system. The confidentiality and integrity impacts are rated as low-to-moderate, as an attacker may access sensitive data or modify system state depending on the privileges of the authenticated session obtained. Availability is not directly impacted. In enterprise environments with AD-integrated Linux/Unix SSH servers, this could facilitate lateral movement across systems that trust the same Kerberos realm (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The EPSS score is approximately 0.177–0.18%, placing it in roughly the 8th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target server to have GSSAPI authentication enabled (off by default) and be joined to a Windows Active Directory domain, which limits the attack surface (Openwall).

1. Reconnaissance: Identify OpenSSH servers (versions before 10.4) that are joined to a Windows Active Directory domain and have GSSAPIAuthentication yes enabled, using network scanning tools such as Nmap with SSH version detection.
2. Obtain a valid Kerberos ticket: As an attacker with access to the AD Kerberos realm (e.g., a compromised domain account), obtain a Kerberos service ticket for an SSH service principal — not necessarily the exact target host's principal, since GSSAPIStrictAcceptorCheck is ineffective.
3. Initiate GSSAPI SSH authentication: Use an SSH client configured for GSSAPI authentication (e.g., ssh -o GSSAPIAuthentication=yes -o GSSAPIDelegateCredentials=yes target-host) and present the obtained Kerberos ticket.
4. Bypass acceptor check: Because GSSAPIStrictAcceptorCheck has no effect in the AD-joined environment, the server accepts the ticket without validating that it was issued for the correct host principal, granting the attacker an authenticated SSH session.
5. Achieve unauthorized access: The attacker gains shell access to the target system under the identity associated with the Kerberos ticket, enabling further actions such as data exfiltration or lateral movement (Openwall, GitHub Advisory).

• Logs: SSH authentication log entries (/var/log/auth.log or /var/log/secure) showing successful GSSAPI logins from unexpected source IPs or for unexpected user accounts; entries indicating Kerberos ticket acceptance without a matching host principal.
• Network: Unexpected Kerberos ticket-granting service (TGS) requests in Active Directory logs for SSH service principals (host/ or ssh/) from unusual client systems; SSH connections (port 22) from hosts not typically used for administrative access.
• Process: Unexpected interactive shell sessions spawned by sshd for privileged or service accounts; unusual commands executed shortly after GSSAPI-authenticated SSH sessions are established.
• Configuration: Presence of GSSAPIAuthentication yes in /etc/ssh/sshd_config on servers confirmed to be AD-joined, combined with OpenSSH versions prior to 10.4.

Upgrade OpenSSH to version 10.4 or later, which adds a documentation note and corrects the behavior of GSSAPIStrictAcceptorCheck in Windows Active Directory environments (Openwall). Ubuntu users should apply the patch provided in USN-8533-1. As a workaround for systems that cannot be immediately upgraded, disable GSSAPI authentication by setting GSSAPIAuthentication no in /etc/ssh/sshd_config and restarting sshd — note that this will break Kerberos-based SSH authentication. After patching, review and verify GSSAPI configuration settings to ensure GSSAPIStrictAcceptorCheck is functioning as intended (Red Hat Bugzilla, GitHub Advisory).

The vulnerability was reported by Yarin Aharoni of Safebreach and acknowledged in the official OpenSSH 10.4 release announcement by Damien Miller (Openwall). Red Hat opened a tracking bug (BZ#2497935) and assigned it medium severity, reflecting the limited default exposure due to GSSAPI authentication being disabled by default (Red Hat Bugzilla). Ubuntu issued security notice USN-8533-1 addressing this and other OpenSSH vulnerabilities. Community reaction has been measured, with the issue noted as a documentation and behavior gap rather than a critical remote code execution flaw.