CVE-2025-15224
Severity
3.1LOW
EPSS
0.1%
top 75.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 8
Latest updateMar 3
Description
When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate using
a locally running SSH agent.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 1.6 | Impact: 1.4
Patches
🔴Vulnerability Details
4OSV▶
CVE-2025-15224: When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate usin↗2026-01-08
GHSA▶
GHSA-hccr-q52r-4w88: When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate usin↗2026-01-08