CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Openssh
  • Openssh
Redhat
  • Enterprise Linux
  • Hardened Images
  • Openshift Container Platform

No data.

No data.

References
Link Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-110924 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-110924 cve-icon
History

Wed, 21 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication openssh: openssh: GSSAPI delegated credentials can be stored after a failed authentication
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state. CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553.
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat hummingbird
Redhat openshift

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Openssh
Openssh openssh
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Openssh
Openssh openssh
Redhat hardened Images
Redhat openshift Container Platform

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state.
Title Openssh: openssh: gssapi delegated credentials can be stored after a failed authentication
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-459
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}
cve-icon MITRE

Status: REJECTED

Assigner: redhat

Published: 2026-10-15T13:07:45.685Z

Updated: 2026-10-21T06:47:43.806Z

Reserved: 2026-10-15T04:33:27.790Z

Link: CVE-2026-110924

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-10-15T14:17:22.387

Modified: 2026-10-21T07:17:17.480

Link: CVE-2026-110924

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T00:00:00Z

Links: CVE-2026-110924 - Bugzilla