Summary
It was discovered that OpenSSH's ssh-agent incorrectly handled interactions
between agent locking and the session-bind@openssh.com extension. A remote
attacker with access to a forwarded agent connection could possibly use
this issue to perform operations that should only be available locally,
such as adding tokens or using keys. (CVE-2026-73281)
It was discovered that OpenSSH's ssh client incorrectly handled concurrent
remote-forwarding operations. A remote attacker could possibly use this
issue to cause a use-after-free condition, resulting in a denial of service
or the execution of arbitrary code. (CVE-2026-73282)
It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keyword from authorized_keys to tunnel forwarding requests. A
local attacker with an authorized key could possibly use this issue to
bypass intended tunnel forwarding restrictions. (CVE-2026-73283)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | openssh | 1:8.9p1-3ubuntu0.17 |
| Ubuntu · 24.04 LTS 24.04:LTS | openssh | 1:9.6p1-3ubuntu13.19 |
| Ubuntu · 26.04 LTS 26.04:LTS | openssh | 1:10.2p1-2ubuntu3.6 |
Vulnerabilities 3
-
Medium 4.8
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding opera…
-
Low 3.5
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, includ…
-
Low 2.5
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwa…