Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux OpenSSH may allow unauthorized login with AD
published 3 months ago
Summary
The OpenSSH packages for AlmaLinux (including client, server, and related tools) can ignore a security setting when the server is connected to a Windows Active Directory, potentially letting attackers bypass authentication. Updating to the latest OpenSSH packages eliminates this weakness. Apply the newest AlmaLinux OpenSSH updates as soon as possible.
What to do
- Update almalinux openssh to version 8.7p1-45.el9_6.tuxcare.els13.
- Update almalinux openssh-askpass to version 8.7p1-45.el9_6.tuxcare.els13.
- Update almalinux openssh-clients to version 8.7p1-45.el9_6.tuxcare.els13.
- Update almalinux openssh-keycat to version 8.7p1-45.el9_6.tuxcare.els13.
- Update almalinux openssh-server to version 8.7p1-45.el9_6.tuxcare.els13.
- Update almalinux openssh-sk-dummy to version 8.7p1-45.el9_6.tuxcare.els13.
- Update almalinux pam_ssh_agent_auth to version 0.10.4-5.45.el9_6.tuxcare.els13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | openssh |
< 8.7p1-45.el9_6.tuxcare.els13 Fix: upgrade to 8.7p1-45.el9_6.tuxcare.els13
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssh-askpass |
< 8.7p1-45.el9_6.tuxcare.els13 Fix: upgrade to 8.7p1-45.el9_6.tuxcare.els13
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssh-clients |
< 8.7p1-45.el9_6.tuxcare.els13 Fix: upgrade to 8.7p1-45.el9_6.tuxcare.els13
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssh-keycat |
< 8.7p1-45.el9_6.tuxcare.els13 Fix: upgrade to 8.7p1-45.el9_6.tuxcare.els13
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssh-server |
< 8.7p1-45.el9_6.tuxcare.els13 Fix: upgrade to 8.7p1-45.el9_6.tuxcare.els13
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssh-sk-dummy |
< 8.7p1-45.el9_6.tuxcare.els13 Fix: upgrade to 8.7p1-45.el9_6.tuxcare.els13
|
| TuxCare:AlmaLinux:9.6 | almalinux | pam_ssh_agent_auth |
< 0.10.4-5.45.el9_6.tuxcare.els13 Fix: upgrade to 0.10.4-5.45.el9_6.tuxcare.els13
|
Original advisory text
openssh: Fix of 6 CVEs
- CVE-2026-59998: document that GSSAPIStrictAcceptorCheck is ineffective when the server is
joined to a Windows Active Directory. Backport upstream commit 8058c5bd.
joined to a Windows Active Directory. Backport upstream commit 8058c5bd.
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784297006.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59995 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59996 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59997 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59998 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59999 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-60000 Vendor Advisory
Timeline
Published17 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784297006 · OSV
Track software like this
Free during beta