CVE-2026-106553 is a low severity flaw (CVSS 2.2) in OpenSSH. In sshd before 10.6, credentials can incorrectly persist after a failed GSSAPIAuthentication attempt. OpenSSH 10.6 was released on 6 October 2026. Upgrade to 10.6 or later, or take your distribution's backport.
What's affected
The record says sshd in OpenSSH before 10.6 is affected. The OpenSSH release notes confirm that 10.6 was released on 2026-10-06. We did not find a sentence in the notes that ties a specific fix to this CVE, so the match between the record and the release rests on the version statement in the record.
The weakness is CWE-669, incorrect resource transfer between spheres. The vector is local, with high attack complexity, low privileges and user interaction, and only a low confidentiality impact. Together these explain a score of 2.2.
The flaw matters only if your sshd allows GSSAPI authentication, the Kerberos style single sign-on method. Many servers leave it off. Distribution packages often backport fixes and keep the old version number, so check your vendor's security tracker before you decide that a version string below 10.6 means you are unpatched.
The release notes also say the OpenSSH team plans more frequent releases, because many security reports now come from AI assisted analysis and the team expects others to find the same bugs.
How to check if you're exposed
Read the installed version:
ssh -V
Then check whether GSSAPI authentication is turned on in the server. This prints the effective setting:
sudo sshd -T | grep -i gssapiauthentication
If it prints gssapiauthentication no, the code path in the record is not in use. If it prints yes, your server accepts GSSAPI logins and the fix is relevant.
On Debian, Ubuntu, Red Hat and similar systems, the package changelog tells you whether the fix was backported. Query the changelog for the CVE number with your package manager rather than relying on the upstream version string alone.
What to do now
- Upgrade to OpenSSH 10.6 or later, or install your distribution's fixed package once available.
- If you do not use Kerberos or GSSAPI single sign-on, set
GSSAPIAuthentication noin sshd_config and reload sshd. - Keep a second session open when you change sshd settings, so a mistake does not lock you out.
- Check the vendor tracker for backported fixes and record the package version that contains it.
- Add OpenSSH to your normal patch cycle, since the project says it now releases more often.
Why it matters
Authentication code keeps state: who is trying to log in, which method they are on, which credentials were obtained. If a failed attempt leaves that state behind, a later step can see data it should not. That is the class the record names, resource transfer between spheres, where something that belongs to one context is carried into another.
The score is deliberately low. The attacker must already have a local account and an unusual set of conditions, and the effect is limited. Even so, a security daemon is a place where small state bugs deserve a fix, because the same shape of bug can be worse in the next version of the code.
There are two companion CVEs in the same release: CVE-2026-106555, about authentication state persisting across attempts, and CVE-2026-106583, about command line usernames. One upgrade covers all three. The record does not flag any of them as known exploited.
Quick check
Do I need to act if GSSAPI is off?
The record describes a GSSAPI authentication problem, so a server with that method disabled is not on the affected path. Upgrading is still a good idea.
Is this CVE known to be exploited?
The record does not flag it as known exploited.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
