CVE-2026-73281: Low severity OpenSSH ssh-agent vulnerability
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73281?
The severity of CVE-2026-73281 is classified as low with a score of 3.5.
How do I fix CVE-2026-73281?
To fix CVE-2026-73281, upgrade to OpenSSH version 10.5 or later.
What are the potential impacts of CVE-2026-73281?
CVE-2026-73281 can lead to unauthorized remote operations on the ssh-agent, which may compromise sensitive tokens or keys.
Is CVE-2026-73281 a remote or local vulnerability?
CVE-2026-73281 is a remote vulnerability, allowing malicious operations that should be local to occur over a network.
What causes the vulnerability in CVE-2026-73281?
CVE-2026-73281 is caused by a misinteraction between agent locking and the session-bind@openssh.com extension in OpenSSH.