Quick answers
- Is CVE-2026-110924 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110924 being exploited in the wild.
- How severe is CVE-2026-110924?
- Medium severity, with a CVSS score of 4.8, published 15 October 2026.
- Which products and versions are affected?
- OpenSSH OpenSSH.
- Is there a fix for CVE-2026-110924?
- No fixed version is recorded yet. Set GSSAPIDelegateCredentials to no in the SSH configuration, or disable GSSAPI authentication entirely by setting GSSAPIAuthentication to no if it is not required. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-110924 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-110924?
- Check whether you run OpenSSH. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Set GSSAPIDelegateCredentials to no in the SSH configuration, or disable GSSAPI authentication entirely by setting GSSAPIAuthentication to no if it is not required.
Technical details
A Kerberos/GSSAPI authentication failure in OpenSSH leaves delegated credentials cached on the connection despite failed user authorization. An attacker can exploit this by first triggering a GSSAPI authentication failure, then performing a successful login attempt on the same connection that leverages the residual credential state to bypass authorization. The attack requires network access and GSSAPI authentication to be enabled, but no privileges or user interaction.
Affected products
- OpenSSH OpenSSH
Timeline
- 2026-10-15: disclosed