CVE-2026-73283Low· 2.5▾ SunlitIn sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.09%
0.09% → 0.1%
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
openssh < 10.5Upgrade past the affected range:
openssh 10.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73282Medium· 4.8In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281Low· 3.5In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys
CVE-2026-106586Low· 2.5In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
CVE-2026-110923Medium· 6.5A flaw was found in OpenSSH
CVE-2026-110925Medium· 5.4A flaw was found in OpenSSH
CVE-2026-110926Medium· 5.3A flaw was found in OpenSSH