CVE-2026-73281

{
  "id": "CVE-2026-73281",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T20:18:49.690",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension."
    },
    {
      "lang": "es",
      "value": "En ssh-agent en OpenSSH anterior a 10.5, algunas operaciones pueden ocurrir remotamente pero estaban destinadas a ocurrir solo localmente, incluyendo operaciones que añaden tokens o usan claves. Esto es causado por una interacción incorrecta entre el bloqueo del agente y la extensión [email protected]."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenBSD",
          "product": "OpenSSH",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "10.5",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T20:16:28.218093Z",
          "id": "CVE-2026-73281",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-669"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "10.5",
              "matchCriteriaId": "85C0FBF8-1AE6-4A15-A6B2-41B5790E88E1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.openssh.org/releasenotes.html#10.5",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    }
  ]
}