CVE-2026-106555 is a low severity flaw (CVSS 2.2) in OpenSSH. In sshd before 10.6, GSSAPIAuthentication state can incorrectly persist across authentication attempts. OpenSSH 10.6 came out on 6 October 2026, so upgrade to that version or later, or apply your vendor's patch.
What's affected
The record says sshd before 10.6 is affected. The OpenSSH release notes show 10.6 / 10.6p1 dated 2026-10-06. The notes we read do not name this CVE, so the link between the CVE and the release comes from the record.
The weakness is CWE-669, incorrect resource transfer between spheres. The vector is local, with high attack complexity, low privileges and user interaction, and a low confidentiality impact. The rating is low for those reasons.
GSSAPI is the generic security interface that Kerberos uses for single sign-on over SSH. If your servers do not offer it, this code does not run for logins. Servers in organisations that use Kerberos or Active Directory with SSH may have it on, and some distributions enable it in default configuration files, so check rather than assume.
Distribution packages frequently carry fixes under an older version number. A version below 10.6 on a managed Linux system does not by itself mean the fix is missing.
How to check if you're exposed
First the version:
ssh -V
Then the effective server setting for GSSAPI:
sudo sshd -T | grep -i gssapi
The output shows gssapiauthentication yes or no, and also the related cleanup option. If authentication is yes, the code in the record is reachable on that host.
For a fleet, run the same check with your configuration management tool and produce a list of hosts with GSSAPI turned on and a version older than 10.6. Match that list against your distribution's security tracker, which will tell you if the fix was backported to your package.
What to do now
- Upgrade to OpenSSH 10.6 or later, or the distribution package that carries the fix.
- Disable GSSAPIAuthentication on hosts that do not need Kerberos single sign-on.
- Reload sshd after a change and test a new session before closing the old one.
- Keep a list of which hosts use GSSAPI and why, so the setting is a decision and not a leftover default.
- Patch the sibling CVEs in the same release: CVE-2026-106553 and CVE-2026-106583.
Why it matters
When a login attempt fails, the server should discard everything it learned during that attempt. This CVE says authentication state for GSSAPI could remain between attempts. Leftover state is a recurring theme in authentication bugs, because the code has many branches and each must clean up after itself.
Severity is low because an attacker would need local access, some privileges and a user to take part, and the effect on confidentiality is small. The practical risk for most teams is close to nothing, and the cost of the fix is a routine package update.
The interesting part is the release. The OpenSSH team says it now receives many security reports, a lot of them found with AI assistance, and that it will release more often so fixes reach users sooner. That is a change in rhythm for anyone who pins to a point release. A patch process that expects a security update once a year will fall behind. The record does not flag this CVE as known exploited.
Quick check
Is this the same bug as CVE-2026-106553?
They are separate CVEs in the same release. One describes credentials persisting after a failure, the other describes state persisting across attempts.
Is any exploitation reported?
The record does not flag it as known exploited.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
