🚨 HIGH - libssh GSSAPIKeyExchange user impersonation (CVE-2026-59851) A flaw in libssh’s GSSAPIKeyExchange (gssapi-keyex) authentication path allows an authenticated client to log in as an arbitrary local user when the server has GSSAPIKeyExchange enabled. The root cause is improper authorization checks: the code fails to verify that the authenticated Kerberos principal is permitted to access the requested local account. An attacker exploits this by completing Kerberos/GSSAPI authentication and then requesting a different target username during key exchange, requiring valid Kerberos credentials and a server configured with GSSAPIKeyExchange. Impact is account impersonation leading to unauthorized access and potential privilege escalation up to full system compromise if high-privilege users (e.g., root) can be targeted. 👉 Affected: libssh servers with GSSAPIKeyExchange enabled (version range not specified) | Upgrade to No fix yet — treat as suspicious
Post summary
The tweet announces a newly disclosed vulnerability (CVE-2026-59851) in libssh’s GSSAPIKeyExchange that allows authenticated users to impersonate local accounts, with detailed technical explanation but no PoC, exploit, or remediation mentioned.