EUVD-2026-38413
GHSA-wcvf-3x75-j4c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker gains local unprivileged account on shared client host
-
DeliveryPre-bind predictable abstract UNIX domain X socket name
-
ExploitVictim initiates SSH session with X11 forwarding enabled
-
ExecutionSSH client routes X11 traffic to attacker-controlled socket
-
ImpactAttacker captures keystrokes, window contents, and sensitive X11 session data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V12 - Secure Communication Improper restriction of communication channel
|
| Exploitation Conditions | X11 forwarding must be explicitly enabled for the SSH client session - either via 'ForwardX11 yes' or 'ForwardX11Trusted yes' in ssh_config, or via the -X or -Y command-line flags. X11 forwarding is not enabled by default in standard OpenSSH configurations, so this is a non-default deployment condition. The client host must be Linux and must use the abstract UNIX domain socket namespace for the local X11 display (not a TCP socket or filesystem-path UNIX socket). The attacker must hold a local unprivileged account on the same client host as the victim (PR:L confirmed by CVSS vector); remote-only attackers cannot exploit this. The victim must actively initiate a new SSH session with X11 forwarding during the window in which the attacker has pre-bound the target socket name (UI:R from CVSS). Exploitation is further limited by the high attack complexity (AC:H), which reflects the timing or pre-binding precision required. Environments where X11 forwarding is administratively disabled system-wide, or where client hosts are single-user systems, are not exposed. |
| Impact | The CVSS 3.1 base score of 5.0 with vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N captures the real-world risk reasonably well. The local attack vector (AV:L) is the most significant limiting factor: the attacker must already have a local unprivileged account on the same client host as the victim, restricting applicability to multi-user environments such as shared developer jump hosts or HPC login nodes. High complexity (AC:H) reflects the pre-binding race or timing requirement to squat the abstract socket name before the victim's SSH session creates it. User interaction (UI:R) further limits exploitability - the victim must actively initiate an SSH session with X11 forwarding enabled, which is not a default configuration in most hardened deployments. Despite these mitigating factors, the C:H rating is significant: successful exploitation can expose passwords typed in X11 applications, session tokens, and sensitive screen contents in full. This vulnerability is not listed in CISA KEV, and no POC exploit code has been identified, so exploitation risk from opportunistic threat actors appears low at this time. EPSS data is not available from the provided intelligence. The realistic priority is moderate: environments running shared Linux systems where X11 forwarding is permitted should treat this as a meaningful local privilege escalation risk against authenticated users, but it does not warrant emergency patching in most enterprise environments. |
| Exploit ScenarioDerived | A malicious unprivileged employee or contractor with a shell account on a shared Linux developer jump host monitors for peer SSH activity and pre-binds the predictable abstract UNIX domain socket name used by OpenSSH X11 forwarding before a privileged colleague initiates their SSH session with X11 enabled. The colleague's SSH client, finding the intended abstract socket already bound, routes the X11 forwarding channel through the attacker-controlled endpoint, giving the attacker a real-time view of the colleague's X11 session including passwords typed in terminal emulators, browser content displayed in X applications, and the ability to inject limited input into the session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
X11 forwarding session hijacking in OpenSSH enables a local unprivileged attacker sharing a Linux client host to intercept and partially manipulate the victim's forwarded X11 display traffic by squatting on the predictable abstract UNIX domain socket name before the SSH client creates it. Affected deployments span OpenSSH packages across Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code has been identified at time of analysis, but successful exploitation yields high-confidence access to sensitive X11 session data including keystrokes, window contents, and clipboard material.
RemediationAI
Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-55655 for the patched OpenSSH package version, as no specific fixed version number has been confirmed in the available intelligence - patch availability per vendor advisory should be assumed pending confirmation. As the primary compensating control, disable X11 forwarding globally by setting 'ForwardX11 no' and 'ForwardX11Trusted no' in /etc/ssh/ssh_config on all client hosts; note this will block legitimate use of X11 application forwarding for users who depend on it. On systems where X11 forwarding is operationally required, restrict shell access to the client host to only trusted personnel to reduce local attacker surface. Migrating X application delivery to Wayland-native protocols eliminates this abstract socket attack surface entirely, though this requires compatible application and compositor support. Review /etc/ssh/ssh_config and per-user ~/.ssh/config files to audit where ForwardX11 or ForwardX11Trusted are enabled and restrict to sessions that genuinely require it.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenSSH's X11 forwarding feature tunnels X Window System display connections from a remote server back through the SSH encrypted channel to the client's local display. On Linux, the local endpoint for this forwarding is an abstract namespace UNIX domain socket - a Linux-specific socket variant identified by a null-byte prefix rather than a filesystem path, making it invisible to filesystem permissions and accessible to any process that knows or can guess the name. CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints) identifies the root cause: the abstract socket name used for X11 forwarding is preferred or predictable, allowing an attacker to pre-bind it before the SSH client does. When the SSH client attempts to create the socket, it finds the name already taken and, depending on the implementation, may fall back to using the attacker's socket as the forwarding endpoint, directing the victim's X11 traffic through the attacker's process. CPE data confirms the affected products are OpenSSH as shipped in Red Hat Enterprise Linux (versions 6, 7, 8, 9, 10), Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4.
Know when SSH gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Local-only attack requiring low-privilege account, race/pre-binding complexity, victim-initiated X11 session, and no availability impact independently support each metric choice.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
Same technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | undetermined | 1:8.4p1-5+deb11u3 | - |
| bullseye (security) | undetermined | 1:8.4p1-5+deb11u7 | - |
| bookworm | undetermined | 1:9.2p1-2+deb12u10 | - |
| bookworm (security) | undetermined | 1:9.2p1-2+deb12u9 | - |
| trixie | undetermined | 1:10.0p1-7+deb13u4 | - |
| trixie (security) | undetermined | 1:10.0p1-7+deb13u2 | - |
| forky, sid | undetermined | 1:10.3p1-4 | - |
| (unstable) | fixed | undetermined | - |
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB