CVE-2026-73283: 
OpenSSH vulnerability analysis and mitigation

CVE-2026-73283 is an authorization bypass vulnerability in OpenSSH's sshd daemon where the restrict keyword in authorized_keys files fails to enforce tunnel forwarding restrictions as intended. All versions of OpenSSH before 10.5 are affected. The vulnerability was published on August 11, 2026, with a patch available in OpenSSH 10.5. It carries a CVSS v3.1 base score of 2.5 (Low) (GitHub Advisory).

The root cause is classified as CWE-670 (Always-Incorrect Control Flow Implementation), meaning the code path responsible for applying the restrict keyword to tunnel forwarding was never correctly executed. In OpenSSH's authorized_keys mechanism, the restrict keyword is intended to disable several features — including tunnel forwarding — for a given key. Due to a control flow defect, the restriction was not applied to tunnel forwarding, allowing it to remain accessible even when explicitly restricted. Exploitation requires local access with low privileges and an SSH key that has the restrict keyword set in authorized_keys (GitHub Advisory).

A local user with low privileges and a restricted SSH key can bypass the intended tunnel forwarding prohibition, establishing SSH tunnel connections that should have been blocked by the restrict keyword in authorized_keys. The impact is limited to integrity (low), with no confidentiality or availability impact. This could allow unauthorized network tunneling through the SSH server, potentially enabling access to otherwise restricted network segments, though the constrained scope and high attack complexity limit the practical blast radius (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.083%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory).

1. Precondition: Attacker must have a valid SSH key whose entry in the server's authorized_keys file includes the restrict keyword, which is intended to disable tunnel forwarding among other features.
2. Attempt tunnel forwarding: Using the restricted key, the attacker initiates an SSH connection with tunnel forwarding requested (e.g., ssh -w any:any user@target for tun-based tunneling).
3. Bypass restriction: Due to the control flow defect in sshd, the restrict keyword is not applied to tunnel forwarding, so the server permits the tunnel to be established despite the intended restriction.
4. Leverage tunnel: The attacker uses the established tunnel to route traffic through the SSH server to otherwise inaccessible network resources (GitHub Advisory).

• Logs: SSH daemon logs (/var/log/auth.log or journalctl -u sshd) showing tunnel forwarding sessions (tun device allocation) for keys that have the restrict keyword set in authorized_keys.
• Network: Unexpected tun or tap network interface activity on the SSH server; unusual traffic routing through the server to internal network segments.
• Process: Presence of active SSH tunnel sessions (ss -tnp or netstat) associated with user accounts whose keys are marked restrict in authorized_keys.

Upgrade OpenSSH to version 10.5 or later, which correctly applies the restrict keyword to tunnel forwarding (GitHub Advisory, OpenSSH Release Notes). As a workaround prior to patching, administrators can explicitly add the no-tunnel option to affected authorized_keys entries in addition to restrict, or disable SSH tunnel forwarding globally by setting PermitTunnel no in sshd_config. If tunnel forwarding is not operationally required, disabling it globally is the safest interim measure.