RHSA-2026:84849LowCVSS 2.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 19, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (2)

CVE-2026-106553 →CVE-2026-106555 →

📋 Description

CVE-2026-106553 — openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication CVE-2026-106555 — openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence

🎯 Affected products23

  • Red Hat Hardened Images
  • openssh-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.3.hum1@src as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.3.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.3.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Set GSSAPIAuthentication to no in the sshd configuration (e.g. /etc/ssh/sshd_config) and reload or restart the sshd service. This flaw only occurs when GSSAPI authentication is enabled, which is not the default configuration, so deployments that do not rely on GSSAPI authentication can disable it to prevent credentials from persisting after a failed authentication attempt. The upstream fix is included in OpenSSH 10.6; for the affected Red Hat Hardened Images package, apply the update once it becomes available through the product's update stream. Workaround: Disable GSSAPI authentication in the SSH daemon configuration if Kerberos-based authentication is not required.

🔗 References (6)