Back Feeds.4Sysops

OpenSSH 10.5 fixes ssh-agent lock bypass that exposed local

Feeds.4Sysops •IT News • August 11, 2026

OpenSSH 10.5 fixes a flaw that made locking ssh-agent less secure by allowing forwarded sessions to perform operations intended for local use. The release also patches an ssh client use-after-free and restores the full effect of the `restrict` option for tunnel forwarding. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenSSH 10.5 Addresses ssh-agent Lock Bypass Vulnerability OpenSSH 10.5 was released on August 11, 2026, to address a security flaw in the ssh-agent that allowed forwarded sessions to bypass local locking mechanisms. This vulnerability could potentially expose decrypted private keys stored in the agent, affecting users who utilize agent forwarding. The flaw was identified in OpenSSH 10.4, where locking the ssh-agent inadvertently disabled checks for requests originating from local versus forwarded connections. Additionally, the update includes a patch for a use-after-free vulnerability in the ssh client and restores the full functionality of the 'restrict' option for tunnel forwarding. Users are encouraged to update to the latest version to mitigate these risks. 2 sources 58

OpenSSH 10.5 fixes ssh-agent lock bypass that exposed local

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)