This is really broad question and not exact. There are two ways how to use GSSAPI for SSH logins:
- GSSAPI Key Exchange - not implemented in openssh, but distributed as a patch (part of RHEL, Fedora, but probably also Debians)
GSSAPIAuthentication - part of openssh
GSSAPI Key Exchange
The plus is certainly the manageability - with GSSAPI key exchange you don't have to even care about host keys. Just register the host to domain.
For key exchange, there are used basically these methods. The first is considered possibly vulnerable, because they use 1024 b primes. They are based on respective DH key exchange methods.
About the GSSAPI Authentication, you use normal SSH key excahnge methods (ECDH preferably), which has to be managed somehow else (certificates?) to mitigate MitM. Then authenticate to remote host using kerberos. This communication is already encrypted so there is no different security question than authenticating to any other service.