In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 3.8 · openbsd, debianNVD modified 2026-10-15 02:17
Affected (CPE criteria) 2
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References 8
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig Product
- https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 Patch
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html Mailing List, Product, Release Notes
- https://www.openssh.com/txt/release-10.0 Release Notes
- https://www.openssh.com/txt/release-7.4 Release Notes
- https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20250425-0002/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html