EUVD-2026-94016
GHSA-jrjw-pc9r-c624
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
SSH tunnel forwarding is network-delivered (AV:N), requires a provisioned restricted key (PR:L) and the specific 'restrict' configuration (AC:H); bypassing the restriction affects integrity only (I:L, C:N, A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
AnalysisAI
OpenSSH servers prior to 10.6 fail to enforce the 'restrict' keyword in authorized_keys against tunnel (tun/tap) forwarding, letting a user who already holds a restricted key open a forwarding tunnel that the administrator explicitly intended to block. This is a control-bypass rather than an access-control failure: the attacker must already possess a valid SSH key provisioned with 'restrict' (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), and the flaw only matters on servers older than 10.6 where tunnel forwarding was the specific capability the keyword was relied on to deny. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker to already hold a valid SSH key whose authorized_keys entry uses the 'restrict' keyword, and that the administrator relied on 'restrict' to deny tunnel (tun/tap device) forwarding, on an OpenSSH server before version 10.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority issue, and the available signals are consistent on that point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade OpenSSH to version 10.6 or later, per the upstream release notes at https://www.openssh.org/releasenotes.html#10.6; this is the only complete fix because the defect is in sshd's handling of the 'restrict' keyword itself. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today