USN-8928-1: OpenSSH vulnerabilities
Ubuntu patched OpenSSH flaws that could allow unintended SFTP writes or leak GSSAPI credentials.
Ubuntu security notice USN-8928-1 covers multiple OpenSSH vulnerabilities. CVE-2026-106552 is an sftp-client path-handling flaw during recursive copy that a remote attacker controlling the server could use to write files to unintended locations. CVE-2026-106553 and CVE-2026-106555 involve sshd mishandling GSSAPIAuthentication state across attempts, which could expose credentials from a previous failed login. The notice also says incorrect use of an LZ77 dictionary coder during compression could let an attacker obtain sensitive information. No exploitation is reported.
- CVE-2026-106552 could let a malicious SFTP server write files to unintended paths.
- CVE-2026-106553 and CVE-2026-106555 concern GSSAPI authentication state across attempts.
- A separate compression issue could expose sensitive information.
Vulnerabilities mentionedAll →
- CVE-2026-1065537.5—Credential persistence after failed GSSAPI auth in OpenSSHpublished · OpenBSD OpenSSH+2 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-106553+2 related CVEs | Credential persistence after failed GSSAPI auth in OpenSSH OpenSSH sshd before 10.6 can keep credentials in place after a GSSAPIAuthentication attempt fails, instead of discarding them when that method does not succeed. The issue is reached over the network with no prior privileges or user interaction when a client tries GSSAPI (Kerberos) authentication and that attempt fails. CVSS rates the impact as high integrity and not confidentiality or availability, consistent with an authentication or authorization state that should not survive a failed GSSAPI login (CWE-669). It affects OpenSSH sshd builds older than 10.6 that have GSSAPI authentication in use, including systems covered by related distribution notices such as Ubuntu USN-8928-1. It is not listed in CISA KEV, and no public proof-of-concept is known. |
It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations. (CVE-2026-106552) It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous failed authentication attempt. (CVE-2026-106553, CVE-2026-106555) It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker could possibly use this issue to obtain sensitive information.…
This source does not provide full text. Read it at ubuntu.com.