ssh-agent in OpenSSH releases prior to 10.5 includes logic that inadvertently allows certain agent operations to be invoked remotely. The flaw stems from a mismatch between the agent locking mechanisms and the session-bind@openssh.com extension, allowing an attacker with remote access to the agent socket to request the addition of tokens or the use of private keys. If executed, these actions could grant the attacker access to the attester's credentials or otherwise manipulate key material that is normally limited to local processes.

OpenSSH implementations distributed by OpenBSD and other vendors are affected. Versions of OpenSSH that are earlier than 10.5 include the unpatched logic described above. The issue arises in environments that use ssh-agent either locally or as part of remote session handling.

With a CVSS score of 3.5, the vulnerability is considered low to moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves remote interaction with the ssh-agent socket, which is typically protected only by local file ownership. Consequently, the risk of exploitation is primarily confined to systems where the agent socket is exposed or improperly secured.