Description
A flaw was found in OpenSSH. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel.
Published: n/a
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Unrestricted tunnel creation via restricted SSH keys
Action: Apply patch
AI Analysis

Impact

The flaw allows the authorized_keys "restrict" keyword to be ignored for tunnel forwarding when PermitTunnel is enabled. A user with a restricted key could still establish an SSH tunnel, permitting unauthorized port forwarding or exfiltration of data. This bypass of key‑level restrictions may enable lateral movement or covert communication channels.

Affected Systems

OpenSSH servers vulnerable to this behavior. No specific version is listed in the advisory, so all installations that use PermitTunnel and authorized_keys entries may be affected.

Risk and Exploitability

The CVSS score of 6.5 designates moderate severity, and the EPSS score is not available. This vulnerability is not listed in the CISA KEV catalog. An attacker who can supply a restricted key to the server or abuse an existing one can exploit the flaw remotely over SSH, bypassing intended access controls to open tunnels.

Generated by OpenCVE AI on October 17, 2026 at 14:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest OpenSSH release that implements the restrict keyword for tunnel forwarding.
  • If an upgrade is not immediately possible, disable the PermitTunnel option in sshd_config to block tunnel creation for all keys.
  • Review all authorized_keys files and remove or correct any restrict entries that rely on tunnel forwarding.
  • Consider enforcing stricter SSH user and key policies to mitigate potential misuse until the patch is applied.

Generated by OpenCVE AI on October 17, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Openssh
Openssh openssh
Vendors & Products Openssh
Openssh openssh

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in OpenSSH. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel.
Title openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding
Weaknesses CWE-284
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

threat_severity

Moderate

Subscriptions

Openssh Openssh
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T00:00:00Z

Links: CVE-2026-110928 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T14:30:09Z

Weaknesses