In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.
CVSS Details
- CVSS 3.1 Base Score: 3.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-keysignUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade opensshUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-keycat | Oct 11, 2026 | Sep 21, 2026 |
| Alpine Linux | — | Upgrade openssh | Sep 1, 2026 | Aug 11, 2026 |
| Amazon_linux_2023 | — | Upgrade openssh-server-debuginfoUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-sk-dummyUpgrade openssh-keycat-debuginfoUpgrade openssh-clientsUpgrade openssh-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-serverUpgrade openssh-debugsourceUpgrade opensshUpgrade pam_ssh_agent_auth-debuginfo | Nov 2, 2026 | Aug 11, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory22 | Sep 14, 2026 | Sep 11, 2026 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 10.5 | Sep 23, 2026 | Aug 11, 2026 |
| Oracle_linux | — | Upgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-askpassUpgrade openssh-keysignUpgrade openssh | Oct 22, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade openssh-keycat-debuginfoUpgrade openssh-keycatUpgrade openssh-debugsourceUpgrade pam_ssh_agent_authUpgrade openssh-askpass-debuginfoUpgrade openssh-serverUpgrade openssh-keysign-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-clientsUpgrade opensshUpgrade openssh-askpassUpgrade openssh-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-keysign | Aug 13, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-clients-debuginfoUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-askpass-debuginfoUpgrade openssh-keycat-debuginfoUpgrade openssh-debugsourceUpgrade openssh-serverUpgrade openssh-server-debuginfoUpgrade openssh-debuginfoUpgrade pam_ssh_agent_auth-debuginfo | Sep 28, 2026 | Sep 22, 2026 |
| Ubuntu | — | Upgrade openssh-clientUpgrade openssh-server | Sep 14, 2026 | Sep 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 11, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub