CVE-2026-73281

Name	CVE-2026-73281
Description	In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1144192

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openssh (PTS)	bullseye	1:8.4p1-5+deb11u3	vulnerable
	bullseye (security)	1:8.4p1-5+deb11u7	vulnerable
	bookworm	1:9.2p1-2+deb12u10	vulnerable
	bookworm (security)	1:9.2p1-2+deb12u9	vulnerable
	trixie	1:10.0p1-7+deb13u4	vulnerable
	trixie (security)	1:10.0p1-7+deb13u2	vulnerable
	forky, sid	1:10.4p1-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
openssh	source	(unstable)	(unfixed)			1144192

https://www.openwall.com/lists/oss-security/2026/08/12/1
https://www.openssh.org/releasenotes.html#10.5