Improper access control in OpenSSH - CVE-2026-73281

Vulnerability identifier: #VU146881

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-73281

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass intended local-only restrictions on agent operations.

The vulnerability exists due to improper access control in ssh-agent session binding handling when processing forwarded agent binding requests while the agent is locked. A remote user can send crafted requests through a forwarded agent to bypass intended local-only restrictions on agent operations.

This may permit adding PKCS#11 tokens and using keys with destination restrictions through a forwarded agent.

OpenSSH
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
openEuler
pam_ssh_agent_auth
openssh-server
openssh-keycat
openssh-debugsource
openssh-debuginfo
openssh-clients
openssh-askpass
openssh
openssh-help
openssh (Red Hat package)
openssh (Ubuntu package)

Install security update from vendor's website.

OpenSSH - update to 10.5p1
pam_ssh_agent_auth - update to 0.10.4-5.21
openssh-server - update to 9.6p1-21
openssh-keycat - update to 9.6p1-21
openssh-debugsource - update to 9.6p1-21
openssh-debuginfo - update to 9.6p1-21
openssh-clients - update to 9.6p1-21
openssh-askpass - update to 9.6p1-21
openssh - update to 9.6p1-21
openssh-help - update to 9.6p1-21
openssh (Red Hat package) - update to 9.9p1-27.el10_2
openssh (Ubuntu package) - addressed in versions 1:8.9p1-3ubuntu0.17, 1:9.6p1-3ubuntu13.19, 1:10.2p1-2ubuntu3.6

• https://www.openwall.com/lists/oss-security/2026/08/12/1
• https://www.openssh.org/txt/release-10.5

• Multiple vulnerabilities in OpenSSH
• Ubuntu update for openssh
• openEuler 24.03 LTS SP3 update for openssh
• openEuler 24.03 LTS SP1 update for openssh
• Red Hat Enterprise Linux 10 update for openssh