UpHeron
All vulnerabilities

Servers and applications

CVE-2026-73281

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

Severity
Low 3.5
Published
11 Aug 2026
Last changed
4 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
10.5
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSHServers and applications · cpe:a:openbsd:openssh
  • Every version before 10.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-73281
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-73281