Improper access control in OpenSSH - CVE-2026-73283

Vulnerability identifier: #VU146883

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-73283

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass forwarding restrictions.

The vulnerability exists due to improper access control in sshd authorized_keys restrict keyword enforcement when handling tunnel forwarding. A remote user can use tunnel forwarding despite intended restrictions to bypass forwarding restrictions.

Tunnel forwarding is administratively disabled by default.

OpenSSH
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
openEuler
pam_ssh_agent_auth
openssh8.4-server-debuginfo
openssh8.4-clients
openssh8.4-server
openssh8.4
openssh8.4-common-debuginfo
openssh8.4-fips
openssh8.4-debugsource
openssh8.4-helpers-debuginfo
openssh8.4-clients-debuginfo
openssh8.4-helpers
openssh8.4-common
openssh-server
openssh-help
openssh-keycat
openssh-debugsource
openssh-debuginfo
openssh-clients
openssh-askpass
openssh
openssh (Red Hat package)
openssh (Ubuntu package)

Install security update from vendor's website.

OpenSSH - update to 10.5p1
pam_ssh_agent_auth - update to 0.10.4-5.23
openssh8.4-server-debuginfo - update to 8.4p1-8.27.1
openssh8.4-clients - update to 8.4p1-8.27.1
openssh8.4-server - update to 8.4p1-8.27.1
openssh8.4 - update to 8.4p1-8.27.1
openssh8.4-common-debuginfo - update to 8.4p1-8.27.1
openssh8.4-fips - update to 8.4p1-8.27.1
openssh8.4-debugsource - update to 8.4p1-8.27.1
openssh8.4-helpers-debuginfo - update to 8.4p1-8.27.1
openssh8.4-clients-debuginfo - update to 8.4p1-8.27.1
openssh8.4-helpers - update to 8.4p1-8.27.1
openssh8.4-common - update to 8.4p1-8.27.1
openssh-server - update to 9.6p1-23
openssh-help - update to 9.6p1-23
openssh-keycat - update to 9.6p1-23
openssh-debugsource - update to 9.6p1-23
openssh-debuginfo - update to 9.6p1-23
openssh-clients - update to 9.6p1-23
openssh-askpass - update to 9.6p1-23
openssh - update to 9.6p1-23
openssh (Red Hat package) - update to 9.9p1-27.el10_2
openssh (Ubuntu package) - addressed in versions 1:8.9p1-3ubuntu0.17, 1:9.6p1-3ubuntu13.19, 1:10.2p1-2ubuntu3.6

• https://www.openwall.com/lists/oss-security/2026/08/12/1
• https://www.openssh.org/txt/release-10.5

• Multiple vulnerabilities in OpenSSH
• Ubuntu update for openssh
• openEuler 24.03 LTS SP3 update for openssh
• Red Hat Enterprise Linux 10 update for openssh
• SUSE update for openssh8.4