Patch Forecast
Amber warning
Patch this week.

CVE-2026-106555

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be…

Risk score
61/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.1%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
Affected
OpenSSH before 10.6
Fix
Upgrade OpenSSH to 10.6 or later.
Exploitation
No known exploitation

Story map

Story map: OpenSSHTHE FLAWSTHE FIXCVE-2026-106555In sshd in OpenSSH before 10.6,GSSAPIAuthenticationauthentication state can…CVSS 7.5 · EPSS 0%CVE-2026-106553In sshd in OpenSSH before 10.6,credentials can incorrectlypersist after failure of a…CVSS 7.5 · EPSS 0%CVE-2026-106583In ssh in OpenSSH before 10.6,a $ or \ character can occur ina command-line username…CVSS 7.8 · EPSS 0%CVE-2026-106552Path traversalCVSS 6.5 · EPSS 0%Upgrade OpenSSH10.6or later on your release lineWho is exposedOpenSSH before 10.6AMBER · PATCH THIS WEEKOpenSSHIn sshd in OpenSSH before 10.6,GSSAPIAuthenticationauthentication state canincorrectly be persisted acrossauthentication attempts.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-669 (CWE-669)7 other warnings in 30 days →Same productEarlier OpenSSH warnings5 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

OpenSSH: Amber, patch this week. In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

The flaws

  • CVE-2026-106555: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106553: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106583: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to… (CVSS 7.8 · EPSS 0%)
  • CVE-2026-106552: Path traversal (CVSS 6.5 · EPSS 0%)

The fix

Upgrade OpenSSH: 10.6 or later on your release line

Who is exposed: OpenSSH before 10.6

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: openssh

References

Original description

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

Last activity 6 Oct 2026. Patch Forecast updates every hour.