CVE-2026-106555: CWE-669 Incorrect Resource Transfer Between Spheres in OpenBSD OpenSSH

This vulnerability (CVE-2026-106555) affects OpenSSH versions prior to 10.6. It involves an incorrect resource transfer between spheres (CWE-669) in the sshd daemon, specifically in the handling of GSSAPIAuthentication. The authentication state can be incorrectly persisted across multiple authentication attempts, which may lead to unintended retention of authentication context. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, limited confidentiality impact, and no integrity or availability impact.

The impact is limited to potential leakage of authentication state across attempts, which could theoretically expose some authentication context. However, the CVSS score of 2.2 and vector indicate low severity with no reported integrity or availability impact. There are no known exploits in the wild. The vulnerability does not appear to allow privilege escalation or remote code execution.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the OpenBSD or OpenSSH vendor advisory for current remediation guidance. Until a patch is available, administrators should consider disabling GSSAPIAuthentication if feasible or monitor authentication attempts closely. Follow vendor advisories for updates.