CVE-2026-73281

A flaw was found in OpenSSH's ssh-agent component. A misinteraction between agent locking and the [email protected] extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS#11 tokens or utilize keys with destination restrictions, bypassing intended security controls.

Red Hat has determined that this vulnerability has limited impact. Exploitation requires an authenticated SSH session with agent forwarding enabled and the agent in a locked state. Only OpenSSH versions 8.9 and later contain the vulnerable [email protected] extension code. Red Hat Enterprise Linux 6, 7, 8, and RHEL 9 through 9.6 ship OpenSSH versions prior to 8.9 and are not affected. Red Hat may apply this fix in a future update for affected products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using ssh-agent forwarding to untrusted remote hosts, or disable agent forwarding entirely by removing ForwardAgent yes from SSH configuration. If agent forwarding is required, avoid locking the agent while forwarded sessions are active.