Back Feeds2.Feedburner

Locking your ssh-agent exposed local

Feeds2.Feedburner •Anamarija Pogorelec • August 11, 2026

Lock your ssh-agent and it should sit there refusing to sign anything until you unlock it. In OpenSSH 10.4, locking it also switched off the check that tells the agent whether a request came from your own machine or arrived down a forwarded connection from a remote server. The fix shipped today in OpenSSH 10.5. The agent holds your decrypted private keys so you are not retyping a passphrase every few minutes, and agent forwarding … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenSSH 10.5 Addresses ssh-agent Lock Bypass Vulnerability OpenSSH 10.5 was released on August 11, 2026, to address a security flaw in the ssh-agent that allowed forwarded sessions to bypass local locking mechanisms. This vulnerability could potentially expose decrypted private keys stored in the agent, affecting users who utilize agent forwarding. The flaw was identified in OpenSSH 10.4, where locking the ssh-agent inadvertently disabled checks for requests originating from local versus forwarded connections. Additionally, the update includes a patch for a use-after-free vulnerability in the ssh client and restores the full functionality of the 'restrict' option for tunnel forwarding. Users are encouraged to update to the latest version to mitigate these risks. 2 sources 58

Extracted Entities

Platforms (1)

OpenSSH