The advisory covers a set of vulnerabilities in OpenSSH RPMs for Red Hat Hardened Images, including CVE-2026-55653, CVE-2026-55654, and CVE-2026-55655. The most detailed vulnerability, CVE-2026-55655, involves a local man-in-the-middle attack on X11 forwarding connections via abstract UNIX socket pre-binding. This flaw allows an attacker with local unprivileged access to intercept and manipulate X11 forwarding traffic if X11 forwarding is enabled on the client. The issue is specific to Red Hat Enterprise Linux OpenSSH client versions and does not affect upstream OpenSSH. The advisory lists updated OpenSSH packages (version 10.3p1-6.hum1) for aarch64 and x86_64 architectures as the fix. No CVSS score is provided by Red Hat, but the severity is rated medium.

The vulnerability allows a local unprivileged attacker to hijack X11 forwarding connections, compromising the confidentiality of forwarded X11 traffic, including sensitive window contents and input. It may also allow manipulation of the forwarded session. Exploitation requires local access and that X11 forwarding is explicitly enabled and in use, which is not the default configuration. This limits the attack surface. The flaw does not affect upstream OpenSSH versions and is specific to Red Hat Enterprise Linux OpenSSH client builds.

Red Hat provides updated OpenSSH RPM packages (version 10.3p1-6.hum1) that address these vulnerabilities. Users should apply these updates to remediate the issues. Additionally, to mitigate the risk of CVE-2026-55655, disable X11 forwarding on OpenSSH clients when it is not required by avoiding the use of '-X' or '-Y' options or by setting 'ForwardX11 no' in the SSH client configuration files (~/.ssh/config or /etc/ssh/ssh_config). Disabling X11 forwarding removes the attack vector for this vulnerability. Since this is a local attack vector requiring explicit configuration, disabling X11 forwarding is an effective mitigation if patching is not immediately possible.