Remote Operation Vulnerability in OpenSSH Affecting Multiple Versions
CVE-2026-73281

3.5LOW

Key Information:

Vendor

OpenBSD
Status
Openssh
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73281?

A security issue exists in OpenSSH where certain operations that should only be performed locally can unintentionally occur remotely. This vulnerability arises from the improper interaction between the agent locking mechanism and the session-bind@openssh.com extension, potentially exposing sensitive tokens and keys. Users are advised to upgrade to OpenSSH version 10.5 or later to mitigate this risk.

Affected Version(s)

OpenSSH 0 < 10.5

References

https://www.openssh.org/releasenotes.html#10.5

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.