OpenSSH ssh-agent: locking bypass lets a forwarded remote session add tokens and use keys

Impact

Operations that ssh-agent was supposed to confine to the local machine - adding tokens and using loaded keys - can be driven from the far end of a forwarded agent socket, because agent locking and the session-bind extension do not interact correctly. On a GPU fleet this matters wherever operators forward their agent into nodes: a hostile or already-compromised node, or another root user on it, can exercise the engineer's keys against the rest of the estate rather than only the box they logged into. Locking the agent, which is the usual habit for exactly this risk, does not stop it. The record scores it 3.5 with scope change and no confidentiality loss; the practical exposure is authentication reach, not key extraction.

Who can reach it

Whoever can reach a forwarded ssh-agent socket on a remote host - a node operator, root on that node, or a co-tenant that obtained the socket. Requires that the user forwarded their agent to that host; no separate credential is needed beyond socket access.

What to do

Upgrade OpenSSH to 10.5 on the machines where ssh-agent runs (operator workstations and bastions, not just the GPU nodes) and restart the agents - a logout/login or fresh agent process picks it up, no node reboot. As an interim measure, stop using ForwardAgent into shared or tenant-adjacent nodes and use ProxyJump instead; that removes the exposure without a package upgrade.

References

Related entries

• Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creatingCVE-2018-20855 · Linux kernel mlx5_ib (create QP response)Low
• Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selection: Setting Speculative Store Bypass Disable on AMD FamilyCVE-2022-42336 · Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selectionLow
• OpenSSH sshd: restrict keyword in authorized_keys did not cover tunnel forwardingCVE-2026-73283 · OpenSSH sshd (authorized_keys restrict keyword vs tunnel forwarding)Low
• QEMU / KVM / Xen (VENOM): VENOM: out-of-bounds write in the virtual Floppy Disk ControllerCVE-2015-3456 · QEMU / KVM / Xen (VENOM)Low
• Xen (shadow paging): x86 shadow paging arbitrary pointer dereference - host crash or worseCVE-2022-42335 · Xen (shadow paging)Unscored
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDCVE-2022-50619 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored