CVE-2026-73281

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.openssh.org/releasenotes.html#10.5	Product Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En ssh-agent en OpenSSH anterior a 10.5, algunas operaciones pueden ocurrir remotamente pero estaban destinadas a ocurrir solo localmente, incluyendo operaciones que añaden tokens o usan claves. Esto es causado por una interacción incorrecta entre el bloqueo del agente y la extensión session-bind@openssh.com.

Information

Published : 2026-08-11 20:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73281

Mitre link : CVE-2026-73281

CVE.ORG link : CVE-2026-73281

JSON object : View

Products Affected

openbsd

openssh

CWE

CWE-669

Incorrect Resource Transfer Between Spheres

{"id": "CVE-2026-73281", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73281", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T20:16:28.218093Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "OpenBSD", "product": "OpenSSH", "versions": [{"status": "affected", "version": "0", "lessThan": "10.5", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T20:18:49.690", "references": [{"url": "https://www.openssh.org/releasenotes.html#10.5", "tags": ["Product", "Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-669"}]}], "descriptions": [{"lang": "en", "value": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension."}, {"lang": "es", "value": "En ssh-agent en OpenSSH anterior a 10.5, algunas operaciones pueden ocurrir remotamente pero estaban destinadas a ocurrir solo localmente, incluyendo operaciones que a\u00f1aden tokens o usan claves. Esto es causado por una interacci\u00f3n incorrecta entre el bloqueo del agente y la extensi\u00f3n session-bind@openssh.com."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85C0FBF8-1AE6-4A15-A6B2-41B5790E88E1", "versionEndExcluding": "10.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}