CVE-2026-73283
published 2026-08-11CVE-2026-73283: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
PriorityP410low2.5CVSS 3.1
AVLACHPRLUINSUCNILAN
EPSS
0.09%
0.4th percentile
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.5 | 10.5 |
| openbsd | openssh | < 10.6 | 10.6 |
| openbsd | openssh | — | — |
| ubuntu | openssh | — | — |
CVSS provenance
nvdv3.12.5LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_ubuntu3.5LOW
vendor_redhat2.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
ghsa_unreviewed·2026-10-06·CVSS 2.5
CVE-2026-106586 [LOW] CWE-670 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
GHSA
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
ghsa_unreviewed·2026-08-11
CVE-2026-73283 [LOW] CWE-670 In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
Red Hat
openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding
vendor_redhat·2026-10-06·CVSS 2.5
CVE-2026-106586 [LOW] CWE-267 openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding
openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
A flaw was found in OpenSSH. In configurations where tunnel forwarding is enabled on the server, the restrict option in the authorized keys configuration fails to properly block tunnel forwarding requests. An authenticated user connecting with a restricted key can exploit this issue to bypass intended access limitations and establish unauthorized network tunnels through the server.
Package: openssh (Red Hat Hardened Images) - Affected
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-09-03·CVSS 3.5
CVE-2026-73281 [LOW] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's ssh-agent incorrectly handled interactions
between agent locking and the [email protected] extension. A remote
attacker with access to a forwarded agent connection could possibly use
this issue to perform operations that should only be available locally,
such as adding tokens or using keys. (CVE-2026-73281)
It was discovered that OpenSSH's ssh client incorrectly handled concurrent
remote-forwarding operations. A remote attacker could possibly use this
issue to cause a use-after-free condition, resulting in a denial of service
or the execution of arbitrary code. (CVE-2026-73282)
It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keywor
Red Hat
openssh: OpenSSH: Tunnel forwarding restriction bypass
vendor_redhat·2026-08-11·CVSS 2.5
CVE-2026-73283 [LOW] CWE-305 openssh: OpenSSH: Tunnel forwarding restriction bypass
openssh: OpenSSH: Tunnel forwarding restriction bypass
A flaw was found in OpenSSH's `sshd` component. The `restrict` keyword, designed to limit tunnel forwarding within the `authorized_keys` file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to unauthorized network access or resource usage through tunnels.
Statement: An authorization bypass flaw was found in OpenSSH's sshd daemon. When processing SSH public key authentication, sshd fails to enforce the restrict keyword in authorized_keys against TUN/TAP tunnel forwarding requests. An authenticated user holding a restricted key can still establish virtual network interface tunnels if tunnel forwarding is globally enabled on the serv
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-110928 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
bugzilla·2026-10-15·CVSS 7.5
CVE-2026-110928 [HIGH] CVE-2026-110928 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
CVE-2026-110928 openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
A flaw was found in OpenSSH sshd. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. A key or certificate principal marked restrict could still open a tunnel when PermitTunnel was enabled. PermitTunnel is disabled by default. This is separate from the tunnel check added in OpenSSH 10.5 (CVE-2026-73283). The RHEL maintainer reported that the downstream patch openssh-10.4p1-CVE-2026-59999.patch is stricter than the upstream fix, so Red Hat Enterprise Linux is not affected. Reserve the CVE for upstream. Do not file RHEL trackers.
Bugzilla
CVE-2026-106586 openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding
bugzilla·2026-10-07·CVSS 2.5
CVE-2026-106586 [LOW] CVE-2026-106586 openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding
CVE-2026-106586 openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
Bugzilla
CVE-2026-73283 openssh: OpenSSH: Tunnel forwarding restriction bypass [fedora-all]
bugzilla·2026-08-17·CVSS 2.5
CVE-2026-73283 [LOW] CVE-2026-73283 openssh: OpenSSH: Tunnel forwarding restriction bypass [fedora-all]
CVE-2026-73283 openssh: OpenSSH: Tunnel forwarding restriction bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
Bugzilla
CVE-2026-73283 openssh: OpenSSH: Tunnel forwarding restriction bypass
bugzilla·2026-08-11·CVSS 2.5
CVE-2026-73283 [LOW] CVE-2026-73283 openssh: OpenSSH: Tunnel forwarding restriction bypass
CVE-2026-73283 openssh: OpenSSH: Tunnel forwarding restriction bypass
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
2026-08-11
Published