CVE-2026-73281CWE-669

CVE-2026-73281

Low · published August 12, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-669 · Incorrect Resource Transfer Between Spheres
Published
2026-08-12T00:18Z
Affected products (1)
ProductVersionsFixed in
openbsd/openssh< 10.510.5
References (1)
https://www.openssh.org/releasenotes.html#10.5 · [email protected]
EPSS history
Timeline
  • 11 AUG 19:10Z
    In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use…
    cvelistv5