OpenSSH ssh-agent CVE-2026-73281

Exploitation requires all of the following: (1) the attacker holds valid SSH credentials and can authenticate to a target system - confirmed by CVSS PR:L; (2) SSH agent forwarding is active for the session, meaning both the client and server have agent forwarding enabled; (3) the session-bind@openssh.com extension is in use, which occurs when modern OpenSSH negotiates this extension during session establishment; and (4) the ssh-agent is in a specific interaction state involving agent locking, per the description. Limiting factors include: authentication is required (not exploitable by anonymous attackers), attack complexity is rated High (AC:H per CVSS) indicating non-trivial preconditions, SSVC confirms the attack is non-automatable, and environments that do not use agent forwarding are entirely unaffected by the remote vector.

Multiple signals converge on a low-to-moderate real-world risk profile despite the network vector. The CVSS base score of 3.5 reflects AC:H (high complexity requiring specific conditions to align) and I:L (limited integrity impact), with no confidentiality or availability impact. PR:L confirms an authenticated SSH session is required, eliminating unauthenticated mass exploitation. SSVC rates exploitation as 'none' and automatable as 'no,' meaning no opportunistic scanning is occurring and exploitation is inherently targeted. No EPSS data was present in the available intelligence to further calibrate probability. The S:C scope change is notable - it signals a trust boundary crossing from the remote session into the local agent - but the downstream impact remains limited to low-integrity unauthorized operations. This is not a fire-drill vulnerability, but environments actively using agent forwarding with ssh-agent should treat patching as a near-term priority rather than routine maintenance, given the sensitivity of key material managed by the agent.

An attacker with valid SSH credentials connects to a target server that has agent forwarding enabled; by exploiting the misinteraction between the agent lock state and the session-bind extension, the attacker sends crafted agent protocol messages from the remote session that the ssh-agent incorrectly processes as locally-authorized, allowing the attacker to add tokens to or perform signing operations with keys held in the local agent. No public exploit code has been identified at time of analysis, and AC:H indicates specific timing or configuration conditions must be met, making this a targeted rather than opportunistic attack.