Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Summary

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.

Timeline

1. Jun 23, 2026, 3:36 AM UTCCVE published
2. Jun 23, 2026, 12:21 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 30, 2026, 7:43 AM UTCRecord last updated

Affected versions

• openssh

  Version range not reported

• openssh

  Version range not reported

• openssh

  Version range not reported

• openssh

  Version range not reported

• openssh

  Version range not reported

• openssh

  Version range not reported

• openssh

  Version range not reported

• openssh-main

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-6.4-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhai/base-image-rocm-7.0-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-rocm-6.4-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-rocm-7.1-rhel9

  Version range not reported

• rhai/base-image-gaudi-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-gaudi-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhai/base-image-rocm-7.14-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rubin-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• openssh

  Version range not reported

• openssh

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 25