CVE-2023-28531

CriticalCVSS 9.8

Published: 17/03/2023(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.22%

81th percentile - higher than 81% of all known CVEs

Summary

The vulnerability in ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Risk Assessment

An attacker could use smartcard keys to authenticate to unauthorized hosts, increasing the risk of uncontrolled access to systems.

Recommendation

It is recommended to immediately update OpenSSH to version 9.3 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.