Dashboard / CVE-2026-73281

CVE-2026-73281

LOW
INFO Priority: 0.01 BB Relevance: 47/100
Published: 2026-08-11 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Changed
C: None
I: Low
A: None

Description

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openbsd openssh < 10.5

References & Advisories (1)

Bug Bounty Relevance

47 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

3.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS — Exploitation Probability

0.16%
Raw Score 0.001580
Percentile 4.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00158
2026-10-28
0.00158

Intelligence Sources

nvd ref →

External Links