CVE-2026-73281: OpenSSH ssh-agent RCE Vulnerability

CVE-2026-73281 Overview

CVE-2026-73281 affects ssh-agent in OpenSSH versions prior to 10.5. The vulnerability allows some operations to occur remotely when they were intended to occur only locally. Affected operations include adding tokens and using keys stored in the agent. The root cause is a misinteraction between agent locking and the session-bind@openssh.com extension.

The issue is classified under [CWE-669]: Incorrect Resource Transfer Between Spheres. OpenSSH released version 10.5 to address the flaw.

Critical Impact
An attacker with limited access to a forwarded agent socket can trigger local-only operations remotely, weakening the trust boundary that session-bind and agent locking are intended to enforce.

Affected Products

OpenSSH ssh-agent versions before 10.5
Systems using agent forwarding with the session-bind@openssh.com extension
Deployments relying on ssh-add -x agent locking as a security boundary

Discovery Timeline

2026-08-11 - CVE-2026-73281 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73281

Vulnerability Analysis

The OpenSSH authentication agent (ssh-agent) holds private keys and performs cryptographic operations on behalf of SSH clients. Two features intersect in this vulnerability: agent locking, which is intended to disable agent operations until unlocked with a passphrase, and the session-bind@openssh.com extension, which binds an agent connection to a specific SSH session to constrain what forwarded agents can do.

When these features interact incorrectly, operations that should be restricted to the local host — including adding new identities or using existing keys — can be triggered across a forwarded agent socket. This subverts the isolation model that operators depend on when forwarding agents to remote hosts.

The attack requires a network-adjacent position, high complexity, and low privileges. Successful exploitation impacts integrity by allowing unauthorized state changes to the agent, though confidentiality and availability are not directly impacted.

Root Cause

The defect resides in the logic that gates agent operations. The agent locking check and the session-bind@openssh.com binding check do not compose correctly, allowing certain requests received over a bound (forwarded) session to bypass the intended local-only restriction. This is an incorrect resource transfer between security spheres [CWE-669].

Attack Vector

An attacker requires access to a forwarded ssh-agent socket on a remote host — for example, a compromised or malicious server the victim has connected to with ssh -A. The attacker sends crafted agent protocol messages that exercise the flawed interaction between locking and session binding. See the OpenSSH Release Notes 10.5 for the vendor's description of the fix.

Detection Methods for CVE-2026-73281

Indicators of Compromise

Unexpected SSH_AGENTC_ADD_IDENTITY or SSH_AGENTC_SIGN_REQUEST operations logged during periods when the agent was expected to be locked
New identities appearing in ssh-add -l output that were not added by the user
Anomalous connections to forwarded agent sockets under $SSH_AUTH_SOCK paths on remote hosts

Detection Strategies

Audit ssh-agent process behavior on jump hosts and shared systems where agent forwarding terminates
Correlate SSH session establishment events with subsequent agent socket activity to identify unexpected key usage
Inventory OpenSSH versions across the fleet and flag any installation earlier than 10.5

Monitoring Recommendations

Enable verbose logging on sshd with LogLevel VERBOSE to capture agent forwarding events
Monitor filesystem access to SSH_AUTH_SOCK sockets on servers that accept agent-forwarded sessions
Alert on installations of OpenSSH packages below version 10.5 through configuration management telemetry

How to Mitigate CVE-2026-73281

Immediate Actions Required

Upgrade OpenSSH to version 10.5 or later on all systems running ssh-agent
Disable agent forwarding to untrusted hosts by removing ForwardAgent yes from ~/.ssh/config entries
Review scripts and automation that rely on ssh-add -x locking as a security control

Patch Information

OpenSSH 10.5 contains the fix for the incorrect interaction between agent locking and the session-bind@openssh.com extension. Refer to the OpenSSH Release Notes 10.5 for release details and apply vendor-provided packages for your Linux distribution.

Workarounds

Avoid agent forwarding entirely; use ProxyJump or per-host keys instead of -A
Use hardware-backed keys (FIDO2, PKCS#11) that require physical confirmation for signing operations
Restrict sshdAllowAgentForwarding to no on multi-tenant or lower-trust hosts

bash

# Disable agent forwarding server-side in /etc/ssh/sshd_config
AllowAgentForwarding no

# Client-side: prefer ProxyJump over agent forwarding
# ~/.ssh/config
Host bastion
    HostName bastion.example.com
    User admin

Host internal
    HostName 10.0.0.10
    ProxyJump bastion
    ForwardAgent no