Patch Forecast
Amber warning
Patch this week.

CVE-2026-106553

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a…

Risk score
61/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.1%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
Affected
OpenSSH before 10.6
Fix
Upgrade OpenSSH to 10.6 or later.
Exploitation
No known exploitation

Story map

Story map: OpenSSHTHE FLAWSTHE FIXCVE-2026-106553In sshd in OpenSSH before 10.6,credentials can incorrectlypersist after failure of a…CVSS 7.5 · EPSS 0%CVE-2026-106555In sshd in OpenSSH before 10.6,GSSAPIAuthenticationauthentication state can…CVSS 7.5 · EPSS 0%CVE-2026-106583In ssh in OpenSSH before 10.6,a $ or \ character can occur ina command-line username…CVSS 7.8 · EPSS 0%CVE-2026-106552Path traversalCVSS 6.5 · EPSS 0%Upgrade OpenSSH10.6or later on your release lineWho is exposedOpenSSH before 10.6AMBER · PATCH THIS WEEKOpenSSHIn sshd in OpenSSH before 10.6,credentials can incorrectlypersist after failure of aGSSAPIAuthenticationauthentication attempt.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-669 (CWE-669)7 other warnings in 30 days →Same productEarlier OpenSSH warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

OpenSSH: Amber, patch this week. In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

The flaws

  • CVE-2026-106553: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106555: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106583: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to… (CVSS 7.8 · EPSS 0%)
  • CVE-2026-106552: Path traversal (CVSS 6.5 · EPSS 0%)

The fix

Upgrade OpenSSH: 10.6 or later on your release line

Who is exposed: OpenSSH before 10.6

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: openssh

References

Original description

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

Last activity 6 Oct 2026. Patch Forecast updates every hour.