Vulnerability-Lookup

RHSA-2026:70719

Vulnerability from csaf_redhat - Published: 2026-09-23 11:21 - Updated: 2026-09-24 17:54

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: openssh: * openssh-10.5p1-1.hum1 (aarch64, x86_64) * openssh-askpass-10.5p1-1.hum1 (aarch64, x86_64) * openssh-clients-10.5p1-1.hum1 (aarch64, x86_64) * openssh-keycat-10.5p1-1.hum1 (aarch64, x86_64) * openssh-keysign-10.5p1-1.hum1 (aarch64, x86_64) * openssh-server-10.5p1-1.hum1 (aarch64, x86_64) * openssh-sk-dummy-10.5p1-1.hum1 (aarch64, x86_64) * openssh-10.5p1-1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-73281

A flaw was found in OpenSSH's `ssh-agent` component. A misinteraction between agent locking and the `session-bind@openssh.com` extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS#11 tokens or utilize keys with destination restrictions, bypassing intended security controls.

3.5 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

CWE-266 - Incorrect Privilege Assignment

Affected products

Fixed 15 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-73282

A flaw was found in OpenSSH. A use-after-free vulnerability exists in the `ssh` client when handling concurrent remote-forwarding operations. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote attacker with high attack complexity could potentially exploit this to achieve low impact on confidentiality and integrity.

5.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 15 products, the same list as for CVE-2026-73281

Threats

Impact Moderate

CVE-2026-73283

A flaw was found in OpenSSH's `sshd` component. The `restrict` keyword, designed to limit tunnel forwarding within the `authorized_keys` file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to unauthorized network access or resource usage through tunnels.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-305 - Authentication Bypass by Primary Weakness

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64	—	Vendor Fix fix Workaround

Known not affected 10 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64	—	Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64	—	Workaround

Threats

Impact Moderate

References

20 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:70719	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-73283	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-73282	external
https://access.redhat.com/security/cve/CVE-2026-73281	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-73281	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514327	external
https://www.cve.org/CVERecord?id=CVE-2026-73281	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73281	external
https://www.openssh.org/releasenotes.html#10.5	external
https://access.redhat.com/security/cve/CVE-2026-73282	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514328	external
https://www.cve.org/CVERecord?id=CVE-2026-73282	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73282	external
https://access.redhat.com/security/cve/CVE-2026-73283	self
https://bugzilla.redhat.com/show_bug.cgi?id=2514321	external
https://www.cve.org/CVERecord?id=CVE-2026-73283	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73283	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nopenssh:\n  * openssh-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-askpass-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-clients-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-keycat-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-keysign-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-server-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-sk-dummy-10.5p1-1.hum1 (aarch64, x86_64)\n  * openssh-10.5p1-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:70719",
        "url": "https://access.redhat.com/errata/RHSA-2026:70719"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73283",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73283"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73282",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73281",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73281"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70719.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-24T17:54:03+00:00",
      "generator": {
        "date": "2026-09-24T17:54:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:70719",
      "initial_release_date": "2026-09-23T11:21:13+00:00",
      "revision_history": [
        {
          "date": "2026-09-23T11:21:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-23T11:39:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-24T17:54:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-askpass-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-askpass-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-askpass-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-askpass@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-clients-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-clients-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-clients-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-clients@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keycat-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-keycat-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-keycat-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keycat@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keysign-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-keysign-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-keysign-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keysign@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-server-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-server-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-server-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-server@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
                "product": {
                  "name": "openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
                  "product_id": "openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-sk-dummy@10.5p1-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.hum1@src",
                "product": {
                  "name": "openssh-0:10.5p1-1.hum1@src",
                  "product_id": "openssh-0:10.5p1-1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-askpass-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-askpass-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-askpass-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-askpass@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-clients-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-clients-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-clients-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-clients@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keycat-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-keycat-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-keycat-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keycat@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keysign-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-keysign-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-keysign-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keysign@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-server-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-server-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-server-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-server@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-sk-dummy-0:10.5p1-1.hum1@x86_64",
                "product": {
                  "name": "openssh-sk-dummy-0:10.5p1-1.hum1@x86_64",
                  "product_id": "openssh-sk-dummy-0:10.5p1-1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-sk-dummy@10.5p1-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src"
        },
        "product_reference": "openssh-0:10.5p1-1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-askpass-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-askpass-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-askpass-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-askpass-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-clients-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-clients-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-clients-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-clients-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keycat-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-keycat-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keycat-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-keycat-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keysign-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-keysign-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keysign-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-keysign-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-server-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-server-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-server-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-server-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-sk-dummy-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64"
        },
        "product_reference": "openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-sk-dummy-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
        },
        "product_reference": "openssh-sk-dummy-0:10.5p1-1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-73281",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-08-11T19:31:35.189709+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514327"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH\u0027s `ssh-agent` component. A misinteraction between agent locking and the `session-bind@openssh.com` extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS#11 tokens or utilize keys with destination restrictions, bypassing intended security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: ssh-agent allows remote execution of local operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has determined that this vulnerability has limited impact. Exploitation requires an authenticated SSH session with agent forwarding enabled and the agent in a locked state. Only OpenSSH versions 8.9 and later contain the vulnerable session-bind@openssh.com extension code. Red Hat Enterprise Linux 6, 7, 8, and RHEL 9 through 9.6 ship OpenSSH versions prior to 8.9 and are not affected. Red Hat may apply this fix in a future update for affected products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73281"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514327",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514327"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73281"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.5",
          "url": "https://www.openssh.org/releasenotes.html#10.5"
        }
      ],
      "release_date": "2026-08-11T19:10:33.079000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T11:21:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70719"
        },
        {
          "category": "workaround",
          "details": "Avoid using ssh-agent forwarding to untrusted remote hosts, or disable agent forwarding entirely by removing `ForwardAgent yes` from SSH configuration. If agent forwarding is required, avoid locking the agent while forwarded sessions are active.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: OpenSSH: ssh-agent allows remote execution of local operations"
    },
    {
      "cve": "CVE-2026-73282",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-11T19:31:39.544427+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514328"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A use-after-free vulnerability exists in the `ssh` client when handling concurrent remote-forwarding operations. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote attacker with high attack complexity could potentially exploit this to achieve low impact on confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A use-after-free flaw exists in OpenSSH\u0027s ssh client during concurrent remote-forwarding processing. When adding a remote forward via the local session multiplexing socket while a server remote-forward open request is pending, realloc data management fails, freeing memory that remains actively referenced. A remote attacker with high attack complexity can exploit this timing window to corrupt process memory, posing a low impact to confidentiality, integrity, and availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514328",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514328"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73282"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.5",
          "url": "https://www.openssh.org/releasenotes.html#10.5"
        }
      ],
      "release_date": "2026-08-11T19:12:24.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T11:21:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70719"
        },
        {
          "category": "workaround",
          "details": "Avoid issuing dynamic remote-forwarding commands over active SSH multiplexing connections, or disable socket multiplexing by setting ControlMaster no in ~/.ssh/config.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client"
    },
    {
      "cve": "CVE-2026-73283",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-08-11T19:31:05.763903+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514321"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH\u0027s `sshd` component. The `restrict` keyword, designed to limit tunnel forwarding within the `authorized_keys` file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to unauthorized network access or resource usage through tunnels.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Tunnel forwarding restriction bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An authorization bypass flaw was found in OpenSSH\u0027s sshd daemon. When processing SSH public key authentication, sshd fails to enforce the restrict keyword in authorized_keys against TUN/TAP tunnel forwarding requests. An authenticated user holding a restricted key can still establish virtual network interface tunnels if tunnel forwarding is globally enabled on the server. This allows authorized users to bypass intended per-key restriction policies, posing a Moderate impact to confidentiality and integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514321",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514321"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73283"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.5",
          "url": "https://www.openssh.org/releasenotes.html#10.5"
        }
      ],
      "release_date": "2026-08-11T19:15:24.335000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-23T11:21:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70719"
        },
        {
          "category": "workaround",
          "details": "Set PermitTunnel no in /etc/ssh/sshd_config to disable TUN/TAP tunnel forwarding server-wide. Alternatively, restrict tunnel permissions for specific users or groups using Match blocks in sshd_config or explicit no-tun directives in authorized_keys.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: OpenSSH: Tunnel forwarding restriction bypass"
    }
  ]
}

CVE-2026-73281 (GCVE-0-2026-73281)

Vulnerability from cvelistv5 – Published: 2026-08-11 19:10 – Updated: 2026-08-11 20:16

Summary

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 20:16 UTC

CWE

CWE-669 - Incorrect Resource Transfer Between Spheres

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://www.openssh.org/releasenotes.html#10.5

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenSSH	Affected: 0 , < 10.5 (custom) cpe:2.3:a:openbsd:openssh::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T20:16:28.218093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T20:16:37.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "CWE-669 Incorrect Resource Transfer Between Spheres",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T19:10:33.079Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openssh.org/releasenotes.html#10.5"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-73281",
    "datePublished": "2026-08-11T19:10:33.079Z",
    "dateReserved": "2026-08-11T19:10:32.710Z",
    "dateUpdated": "2026-08-11T20:16:37.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73282 (GCVE-0-2026-73282)

Vulnerability from cvelistv5 – Published: 2026-08-11 19:12 – Updated: 2026-08-11 20:17

Summary

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 20:17 UTC

CWE

CWE-416 - Use After Free

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://www.openssh.org/releasenotes.html#10.5

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenSSH	Affected: 0 , < 10.5 (custom) cpe:2.3:a:openbsd:openssh::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T20:17:11.294681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T20:17:22.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T19:12:24.334Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openssh.org/releasenotes.html#10.5"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-73282",
    "datePublished": "2026-08-11T19:12:24.334Z",
    "dateReserved": "2026-08-11T19:12:24.011Z",
    "dateUpdated": "2026-08-11T20:17:22.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73283 (GCVE-0-2026-73283)

Vulnerability from cvelistv5 – Published: 2026-08-11 19:15 – Updated: 2026-08-11 20:16

Summary

In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

Severity

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 20:16 UTC

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://www.openssh.org/releasenotes.html#10.5

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenSSH	Affected: 0 , < 10.5 (custom) cpe:2.3:a:openbsd:openssh::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73283",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T20:16:49.734390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T20:16:58.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T19:15:24.335Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openssh.org/releasenotes.html#10.5"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-73283",
    "datePublished": "2026-08-11T19:15:24.335Z",
    "dateReserved": "2026-08-11T19:15:24.007Z",
    "dateUpdated": "2026-08-11T20:16:58.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:70719

CVE-2026-73281 (GCVE-0-2026-73281)

CVE-2026-73282 (GCVE-0-2026-73282)

CVE-2026-73283 (GCVE-0-2026-73283)

Tags

Sightings

Nomenclature

Related by attack behaviour