VULNERABILITY INTELLIGENCE

CVE-2026-73281

CVSS score3.5 LOW
EPSS probability0.16%
CISA KEVNot currently listed
Published2026-08-11
Last modified2026-10-24
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Description

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

Weakness classification

  • cve@mitre.org: CWE-669

Primary references