CVE-2026-60000: OpenSSH GSSAPI MaxAuthTries Denial of Service Vulnerability

Technical summary

The vulnerability stems from improper enforcement of the MaxAuthTries limit specifically for GSSAPI authentication attempts in OpenSSH's sshd daemon. MaxAuthTries is intended to prevent brute-force attacks and resource exhaustion by limiting the number of failed authentication attempts allowed per connection. When GSSAPI authentication (IETF RFC 2743) is configured, this limit is either not properly enforced or is bypassed, allowing an attacker to exhaust connection resources through repeated authentication requests. The flaw is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating insufficient rate-limiting or resource quotas on the authentication mechanism itself.

Business impact

The primary impact is potential service disruption. An attacker exploiting this vulnerability could consume excessive system resources (memory, CPU, file descriptors) through malformed or repeated GSSAPI authentication attempts, potentially rendering the SSH service slow or unresponsive for legitimate users. Organizations relying on SSH for critical remote administration, automated deployments, or scheduled batch jobs could experience operational delays. The impact is heightened in environments where GSSAPI is actively used for Kerberos-based authentication. Recovery typically requires manual intervention to kill offending sessions or restart sshd, creating brief administrative overhead.

Affected systems

OpenSSH versions prior to 10.4 are affected. The vulnerability only manifests when GSSAPI authentication (GSSAPIAuthentication) is explicitly enabled in the sshd configuration; default configurations with GSSAPI disabled are not exploitable. Affected installations commonly include enterprise environments using Kerberos or SPNEGO for single sign-on, as well as research institutions and hybrid cloud deployments that bridge on-premises Kerberos realms with remote systems. Systems running OpenSSH 10.4 or later are not vulnerable.

Exploitability

Exploitation requires network access to the SSH port (typically 22) but no prior authentication or credentials. However, the attack complexity is rated as 'High,' meaning specific conditions must be in place: GSSAPI authentication must be configured on the target system, and the attacker must craft multiple GSSAPI authentication exchanges to trigger resource exhaustion. This is not a trivial network scan or one-packet exploit; it requires sustained, deliberate malicious traffic. The attack cannot result in unauthorized access (no confidentiality or integrity impact) and is primarily a nuisance denial-of-service, making it less attractive to opportunistic threat actors compared to remote code execution vulnerabilities. However, determined adversaries seeking to disrupt specific services could leverage it.

Remediation

Upgrade OpenSSH to version 10.4 or later. Organizations unable to patch immediately should consider network-based mitigations: restrict SSH access to trusted IP ranges via firewall rules, implement rate-limiting at the network edge or load balancer level, and monitor SSH connection logs for patterns of repeated failed GSSAPI attempts. If GSSAPI authentication is not required in your environment, disabling it (GSSAPIAuthentication no in sshd_config) immediately eliminates the attack surface while patches are staged.

Patch guidance

Consult your operating system vendor's security advisory and release notes for OpenSSH 10.4 or later. On Linux systems, this typically means upgrading the openssh-server package through your distribution's package manager (apt, yum, dnf, etc.). On OpenBSD, follow the official errata patches. Verify the patched version running 'sshd -v' after installation, and restart the sshd service to activate the fix. Test SSH connectivity (including GSSAPI-based logins if applicable) in a staging environment before deploying to production. No configuration changes are required post-patch; the MaxAuthTries enforcement becomes automatic.

Detection guidance

Monitor sshd logs (typically /var/log/auth.log on Linux or /var/log/authlog on OpenBSD) for repeated failed GSSAPI authentication attempts from a single source IP within a short time window. Look for entries indicating 'gssapi' in the authentication method field and failed status. Tools like fail2ban or similar intrusion prevention systems can be configured to trigger alerts or temporary IP bans when this pattern is detected. Network-based detection could involve IDS/IPS rules monitoring for excessive SSH protocol negotiation or authentication exchanges from a single client without successful completion. No specialized forensics are required post-attack; standard SSH audit logs will show the source and frequency of malicious attempts.

Why prioritize this

This vulnerability should be scheduled in your normal quarterly or bi-annual patching cycle rather than treated as an emergency. The low CVSS score (3.7), high attack complexity, and lack of KEV (known exploited vulnerability) designation reflect its limited real-world threat. However, it should not be indefinitely deferred, especially in environments with active GSSAPI deployments. Prioritize patching after critical and high-severity vulnerabilities, but include it in planned maintenance windows to maintain defense-in-depth and reduce overall SSH attack surface.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW severity) reflects a network-reachable vulnerability with no authentication required but high attack complexity and no impact on confidentiality or integrity. Only availability is affected, and only partially (denial of service, not total system compromise). The 'High' attack complexity component acknowledges that GSSAPI must be explicitly configured and the attacker must sustain malicious traffic—this is not a one-click or drive-by exploit. The absence from the NVD KEV catalog further indicates that this flaw has not been observed in active exploitation campaigns at scale, reducing its urgency relative to other vulnerabilities competing for patching resources.

Frequently asked questions