Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions (Red Hat Red Hat Enterprise Linux 10)

CVE-2026-55655
MEDIUM 5.0

At a glance

Source
NVD
EPSS
EPSS 0.12 % · percentile 2 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Modified

Search on…

Description

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

Weaknesses (CWE)

  • CWE-923 — Improper Restriction of Communication Channel to Intended Endpoints

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.0CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:Nredhat
CVSS 3.1MEDIUM 5.0CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:NNVD · secalert@redhat.com (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Red Hat · Red Hat Enterprise Linux 10unaffected 0:9.9p1-25.el10_2 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:9.9p1-7.el10_0.5 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:8.0p1-30.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:8.0p1-30.el8_10 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:9.9p1-9.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:9.9p1-9.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:8.7p1-30.el9_2.13 < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:8.7p1-38.el9_4.10 < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:8.7p1-45.el9_6.5 < *
Red Hat · Red Hat Hardened Imagesunaffected 10.3p1-6.hum1 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818590 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818589 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818505 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818496 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818502 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1793042072 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818602 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818598 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818512 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818587 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD