CVE-2026-73283

A flaw was found in OpenSSH's sshd component. The restrict keyword, designed to limit tunnel forwarding within the authorized_keys file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to unauthorized network access or resource usage through tunnels.

An authorization bypass flaw was found in OpenSSH's sshd daemon. When processing SSH public key authentication, sshd fails to enforce the restrict keyword in authorized_keys against TUN/TAP tunnel forwarding requests. An authenticated user holding a restricted key can still establish virtual network interface tunnels if tunnel forwarding is globally enabled on the server. This allows authorized users to bypass intended per-key restriction policies, posing a Moderate impact to confidentiality and integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Set PermitTunnel no in /etc/ssh/sshd_config to disable TUN/TAP tunnel forwarding server-wide. Alternatively, restrict tunnel permissions for specific users or groups using Match blocks in sshd_config or explicit no-tun directives in authorized_keys.