The vulnerability CVE-2026-55655 in OpenSSH allows a local unprivileged attacker on a Linux client host to hijack client-side X11 forwarding connections. This is achieved by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. Successful exploitation compromises confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow manipulation of the forwarded session. Red Hat has issued security advisories and updates for OpenSSH packages in Red Hat Enterprise Linux 10 Hardened Images and Red Hat Enterprise Linux 8 to address this issue.

The vulnerability impacts confidentiality by allowing local attackers to intercept and potentially manipulate X11 forwarding traffic on affected systems. This compromises sensitive window contents and user input forwarded over the X11 channel. The integrity impact is low, as manipulation is limited, and availability is not affected. The CVSS 3.1 base score is 5.0 (medium severity) with attack vector local, high attack complexity, low privileges required, user interaction required, and high confidentiality impact.

Red Hat has released official security updates that fix this vulnerability. Users should apply the updated OpenSSH packages as provided in the Red Hat advisories RHSA-2026:36759 for Red Hat Hardened Images and RHSA-2026:47755 for Red Hat Enterprise Linux 8. Applying these updates mitigates the vulnerability. No additional mitigation steps are indicated by the vendor advisory.