CVE-2026-55655: Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-30
Weakness: CWE-923

Description

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

Affected products

OpenSSH: all versions
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0 (and their updates)
Red Hat Enterprise Linux 10: all versions — fixed in 0:9.9p1-25.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:9.9p1-7.el10_0.5
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:8.0p1-30.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:9.9p1-9.el9_8
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:8.7p1-30.el9_2.13
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:8.7p1-38.el9_4.10
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:8.7p1-45.el9_6.5
Red Hat Hardened Images: all versions — fixed in 10.3p1-6.hum1
Red Hat OpenShift AI 3.0: all versions — fixed in 1791818590
Red Hat OpenShift AI 3.2: all versions — fixed in 1791818602
Red Hat OpenShift AI 3.3: all versions — fixed in 1791818782
Red Hat OpenShift AI 3.4: all versions — fixed in 1791883722
Red Hat OpenShift AI 3.5: all versions — fixed in 1791819252
Red Hat Update Infrastructure 5: all versions — fixed in 1786435483

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:9.9p1-25.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:9.9p1-7.el10_0.5; Red Hat Enterprise Linux 8 0:8.0p1-30.el8_10; Red Hat Enterprise Linux 9 0:9.9p1-9.el9_8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:8.7p1-30.el9_2.13; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:8.7p1-38.el9_4.10; Red Hat Enterprise Linux 9.6 Extended Update Support 0:8.7p1-45.el9_6.5; Red Hat Hardened Images 10.3p1-6.hum1; Red Hat OpenShift AI 3.0 1791818590; Red Hat OpenShift AI 3.2 1791818602; Red Hat OpenShift AI 3.3 1791818782; Red Hat OpenShift AI 3.4 1791883722. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-55655 or the next vulnerability affects your stack