OpenSSH client X11 forwarding: a local user can pre-bind the X socket and hijack a forwarded session

Impact

On a host where users run the OpenSSH client with X11 forwarding enabled and a local UNIX-domain X socket, an unprivileged local user can claim the preferred abstract socket name first and intercept another user's forwarded X11 traffic. That exposes window contents and keystrokes of the hijacked session and permits some manipulation of it. The realistic target in a GPU estate is a shared HPC login or head node where many users hold shells on the same machine and forward X for profilers and visualization tools. Headless compute nodes with no X11 forwarding in use are not exposed by this flaw.

Who can reach it

A local unprivileged user with a shell on the same client host as the victim, who must then start an X11-forwarded SSH session (the CVSS vector requires user interaction). No remote access and no elevated privilege is needed by the attacker.

What to do

Update the OpenSSH client packages; Red Hat has shipped errata across RHEL 8, 9 and 10 (RHSA-2026:36759 and the RHSA-2026:47755/47756/47757 and 2026:54387 series), and the record does not name upstream fixed versions. No reboot and no sshd restart is required for the client side; new sessions pick up the fixed binary. Where a maintenance window is not available, mitigate on multi-user login nodes by setting ForwardX11 no and ForwardX11Trusted no in ssh_config and having users tunnel graphical tools another way.

References