Medium severity5.0NVD Advisory· Published Jun 23, 2026· Updated Nov 5, 2026
CVE-2026-55655
CVE-2026-55655
Description
A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
16- osv-coords9 versionspkg:rpm/almalinux/openssh-keycatpkg:rpm/almalinux/openssh-clientspkg:rpm/almalinux/pam_ssh_agent_authpkg:rpm/almalinux/openssh-askpasspkg:rpm/almalinux/opensshpkg:rpm/almalinux/openssh-serverpkg:rpm/almalinux/openssh-ldappkg:rpm/almalinux/openssh-cavspkg:rpm/almalinux/openssh-keysign
< 8.0p1-30.el8_10+ 8 more
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 0.10.3-7.30.el8_10
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 8.0p1-30.el8_10
- (no CPE)range: < 9.9p1-25.el10_2.alma.1
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
50- access.redhat.com/security/cve/CVE-2026-55655nvdVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
- access.redhat.com/errata/RHSA-2026:36759nvd
- access.redhat.com/errata/RHSA-2026:47755nvd
- access.redhat.com/errata/RHSA-2026:47756nvd
- access.redhat.com/errata/RHSA-2026:47757nvd
- access.redhat.com/errata/RHSA-2026:54387nvd
- access.redhat.com/errata/RHSA-2026:58981nvd
- access.redhat.com/errata/RHSA-2026:76748nvd
- access.redhat.com/errata/RHSA-2026:76993nvd
- access.redhat.com/errata/RHSA-2026:80513nvd
- access.redhat.com/errata/RHSA-2026:82749nvd
- access.redhat.com/errata/RHSA-2026:82750nvd
- access.redhat.com/errata/RHSA-2026:82751nvd
- access.redhat.com/errata/RHSA-2026:82752nvd
- access.redhat.com/errata/RHSA-2026:82753nvd
- access.redhat.com/errata/RHSA-2026:82754nvd
- access.redhat.com/errata/RHSA-2026:82755nvd
- access.redhat.com/errata/RHSA-2026:82756nvd
- access.redhat.com/errata/RHSA-2026:82757nvd
- access.redhat.com/errata/RHSA-2026:82758nvd
- access.redhat.com/errata/RHSA-2026:82759nvd
- access.redhat.com/errata/RHSA-2026:82761nvd
- access.redhat.com/errata/RHSA-2026:82762nvd
- access.redhat.com/errata/RHSA-2026:82763nvd
- access.redhat.com/errata/RHSA-2026:82897nvd
- access.redhat.com/errata/RHSA-2026:82898nvd
- access.redhat.com/errata/RHSA-2026:82899nvd
- access.redhat.com/errata/RHSA-2026:82900nvd
- access.redhat.com/errata/RHSA-2026:82901nvd
- access.redhat.com/errata/RHSA-2026:82902nvd
- access.redhat.com/errata/RHSA-2026:82903nvd
- access.redhat.com/errata/RHSA-2026:82904nvd
- access.redhat.com/errata/RHSA-2026:82907nvd
- access.redhat.com/errata/RHSA-2026:82908nvd
- access.redhat.com/errata/RHSA-2026:82909nvd
- access.redhat.com/errata/RHSA-2026:82910nvd
- access.redhat.com/errata/RHSA-2026:82912nvd
- access.redhat.com/errata/RHSA-2026:82913nvd
- access.redhat.com/errata/RHSA-2026:82914nvd
- access.redhat.com/errata/RHSA-2026:82915nvd
- access.redhat.com/errata/RHSA-2026:82916nvd
- access.redhat.com/errata/RHSA-2026:82917nvd
- access.redhat.com/errata/RHSA-2026:82918nvd
- access.redhat.com/errata/RHSA-2026:82920nvd
- access.redhat.com/errata/RHSA-2026:82921nvd
- access.redhat.com/errata/RHSA-2026:82922nvd
- access.redhat.com/errata/RHSA-2026:82923nvd
- access.redhat.com/errata/RHSA-2026:89739nvd
- access.redhat.com/errata/RHSA-2026:91232nvd
News mentions
0No linked articles in our index yet.