Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
Summary
| CVE | CVE-2026-55655 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-23 04:17:40 UTC |
| Updated | 2026-10-26 04:17:57 UTC |
| Description | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session. |
Risk And Classification
Primary CVSS: v3.1 6.1 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
EPSS: 0.001320000 probability, percentile 0.024640000 (date 2026-10-14)
Problem Types: CWE-923 | CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.1 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N |
| 3.1 | [email protected] | Secondary | 5 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N |
| 3.1 | CNA | CVSS | 5 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
LowAvailability
NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Openbsd | Openssh | - | All | All | All |
| Operating System | Redhat | Enterprise Linux | 10.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:9.9p1-25.el10_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 0:9.9p1-7.el10_0.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:8.0p1-30.el8_10 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:8.0p1-30.el8_10 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:9.9p1-9.el9_8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:9.9p1-9.el9_8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | unaffected 0:8.7p1-30.el9_2.13 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions | unaffected 0:8.7p1-38.el9_4.10 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:8.7p1-45.el9_6.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Hardened Images | unaffected 10.3p1-6.hum1 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.0 | unaffected 1791818590 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.0 | unaffected 1791818589 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.0 | unaffected 1791818505 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.0 | unaffected 1791818496 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.0 | unaffected 1791818502 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.2 | unaffected 1791818602 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.2 | unaffected 1791818598 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.2 | unaffected 1791818512 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.2 | unaffected 1791818587 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.2 | unaffected 1791818778 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.2 | unaffected 1791818512 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818782 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818782 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818627 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818790 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818874 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818792 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818662 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.3 | unaffected 1791818877 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791883722 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791881612 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791885618 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791881487 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791881732 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791883315 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791881486 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791881769 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1791885505 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791819252 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791818749 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791819206 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791818979 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791819123 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791818901 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791820333 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791819495 * rpm | Not specified |
| CNA | Red Hat | Red Hat OpenShift AI 3.5 | unaffected 1791819104 * rpm | Not specified |
| CNA | Red Hat | Red Hat Update Infrastructure 5 | unaffected 1786435483 * rpm | Not specified |
| CNA | Red Hat | Red Hat Update Infrastructure 5 | unaffected 1786533529 * rpm | Not specified |
| CNA | Red Hat | Red Hat Update Infrastructure 5 | unaffected 1787135742 * rpm | Not specified |
| CNA | Red Hat | Red Hat Update Infrastructure 5 | unaffected 1787241260 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:82749 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82900 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82922 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82917 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82897 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82752 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82753 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82916 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82901 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82923 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82750 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82915 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82902 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82920 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82899 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82903 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82921 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82914 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82751 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:58981 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82898 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82918 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82762 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82757 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82912 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:80513 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54387 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82909 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:47757 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82913 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82756 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82904 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82763 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:47756 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82908 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:76748 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-55655 | [email protected] | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:47755 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82759 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82910 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82755 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:82907 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:76993 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:89739 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82758 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82761 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36759 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:82754 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by In partnership with Red Hat (Aisle.com). (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-26T18:39:13.000Z | Reported to Red Hat. |
| CNA | 2026-06-22T23:22:11.127Z | Made public. |
Workarounds
CNA: To mitigate this issue, disable X11 forwarding on OpenSSH clients when it is not required. This can be achieved by avoiding the use of `-X` or `-Y` options when invoking `ssh`, or by setting `ForwardX11 no` in the SSH client configuration file (`~/.ssh/config` or `/etc/ssh/ssh_config`). Disabling X11 forwarding will prevent the client from attempting to establish X11 connections, thereby removing the attack vector.
There are currently no legacy QID mappings associated with this CVE.