libssh EUVD-2026-46268

Exploitation requires the target SSH server to be built on libssh and explicitly configured with GSSAPIKeyExchange enabled (the vulnerable gssapi-keyex authentication path), which is not the default configuration. The attacker must already possess a valid, authenticated Kerberos principal in the server's realm (CVSS PR:L confirms authentication is required), but that principal does not need any authorized relationship to the account being impersonated. No user interaction is needed (UI:N) and the attack is fully network-based (AV:N). Limiting factors that reduce realistic risk: the non-default GSSAPIKeyExchange setting, the prerequisite of holding a legitimate Kerberos credential, and the requirement that a Kerberos/GSSAPI environment be deployed at all - hosts without GSSAPI key exchange are not exposed.

The signals point to a genuine, actionable priority in Kerberos/GSSAPI-enabled environments, but with an important scoping caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity attack that nonetheless requires prior privileges (PR:L) - here, possession of a valid Kerberos principal - so this is an authenticated attack, not an unauthenticated one. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so exploitation probability cannot be quantified and no public exploit is identified at time of analysis. The critical limiting factor is configuration: the vulnerable gssapi-keyex path is only active when GSSAPIKeyExchange is enabled, which is not the default on most deployments. Net assessment: high impact (arbitrary user login, full C/I/A on the host) and low attack complexity, but gated behind both valid Kerberos authentication and a non-default server configuration, which meaningfully narrows the exposed population relative to the raw 8.8 score.

An attacker who holds any valid Kerberos principal in the realm (for example a low-privileged domain user or a compromised service account) connects over the network to a libssh-based SSH server that has GSSAPIKeyExchange enabled and completes gssapi-keyex authentication while requesting a different, higher-value local username such as root or an application service account. Because the server never checks that their principal is authorized for that account, the login succeeds and they obtain that user's shell and privileges. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means the abuse requires only a standard SSH client interaction once a valid credential is held.