EUVD-2026-56892
GHSA-97p6-qxmv-h7jm
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitation requires an authenticated SSH session with a 'restrict'-marked authorized_keys entry (PR:L, AC:H); only a tunnel-policy bypass occurs with no confidentiality or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
AnalysisAI
OpenSSH sshd before version 10.5 fails to enforce the restrict keyword in authorized_keys against tunnel forwarding, allowing a constrained SSH key holder to establish tun-device tunnels that the administrator explicitly intended to block. The flaw affects all OpenSSH releases prior to 10.5 and is classified as a policy-enforcement bypass with low integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must simultaneously be true for this bypass to be relevant: (1) the target system runs OpenSSH sshd in any version prior to 10.5; (2) the attacking user possesses a valid private key whose corresponding public key entry in `authorized_keys` includes the `restrict` keyword; and (3) the administrator's intent was that `restrict` should prevent tunnel forwarding for that key - meaning the bypass only matters where that policy is security-relevant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals converge on very low real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An SSH user whose public key is listed in `authorized_keys` with the `restrict` keyword - intended by the administrator to block tunnel forwarding among other capabilities - discovers the enforcement gap and invokes `ssh -w any:any user@target` to establish a tun-device tunnel. Because sshd in OpenSSH before 10.5 does not enforce `restrict` against this subsystem, the tunnel is permitted, allowing the user to route arbitrary network traffic through the server in violation of the intended access policy. … |
| Remediation | The primary fix is upgrading sshd to OpenSSH 10.5 or later, which correctly enforces the `restrict` keyword against tunnel forwarding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today