OpenSSH 10.5 Fixes ssh-agent Lock That Exposed Local-Only Keys

OpenSSH 10.5 and portable 10.5p1 shipped on August 11, 2026. The headline security fix is in ssh-agent: locking the agent interacted badly with the session-bind@openssh.com extension that marks a forwarded agent. Binding requests were refused while the agent was locked, so operations meant to be local-only could run down a forwarded connection. The official notes credit sn0x-sharma.

This piece walks the official release notes and the Help Net Security write-up of the same day. It does not invent a CVE number the project did not print. The action is to get 10.5 onto laptops and jump hosts that lock the agent and still forward it.

What happened

In OpenSSH 10.4, locking ssh-agent also switched off the check that tells the agent whether a request came from the local machine or arrived over agent forwarding. A locked agent refused session-bind requests. A request that never gets bound looks local. Help Net Security's August 11 briefing is blunt about the result: someone who locked the agent before stepping away made it more permissive, not less.

The official notes list two other security fixes in the same cut. ssh can hit a realloc use-after-free if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open is still pending; Brian Mingus of Cognatory reported that one. sshd's authorized_keys restrict keyword did not apply to tunnel forwarding (tunnels are off by default). Erichen at the Institute of Computing Technology, Chinese Academy of Sciences, reported that.

Who is exposed

Anyone who locks ssh-agent and also forwards that agent to a remote host is in the first circle. The exposed operations named in the notes are adding PKCS#11 tokens and using keys that carry destination restrictions — keys that are only supposed to reach one host. A forwarded session that the agent now treats as local can use those keys and load tokens the user thought were locked away.

The multiplex UAF is a client-side condition for people who add remote forwards over ControlMaster while another forward is still opening. The restrict/tunnel miss only matters if an administrator turned PermitTunnel on. Portable OpenSSH 10.5 also now requires ECC, including NISTP521, in libcrypto; LibreSSL, OpenSSL, BoringSSL, and AWS LC ship that in default builds. The --without-openssl configuration is not affected.

What to do now

Upgrade clients and jump-host agents to OpenSSH 10.5 or 10.5p1. Confirm the version with ssh -V on developer laptops, bastion images, and any container that still ships 10.4. Distro packages will lag the upstream tarball; track the portable checksums on the official notes if you build your own.

Until the package lands, treat a locked-and-forwarded agent as not locked. Do not leave ssh-agent -c locked while ForwardAgent is on. Prefer destination-constrained keys only after 10.5, and do not add PKCS#11 tokens to an agent you also forward. If you rely on authorized_keys restrict, re-read that stanza against tunnel forwarding even though tunnels stay off by default.

How the issue works

ssh-agent holds decrypted private keys so you are not retyping a passphrase. Agent forwarding lets a program on a remote host ask that agent to sign. To keep the two cases apart, the client sends a session-bind@openssh.com request that identifies a forwarded agent. Local-only operations — PKCS#11 load, destination-restricted keys — are supposed to be refused on a forwarded bind.

A locked agent refused those bind requests. The agent then had no bind on the connection, so it classified the request as local. The lock, which users treat as a pause, removed the very signal that enforced the local/remote split. That is the interaction the 10.5 notes fix. The two companion fixes are separate: a client realloc path around multiplexed remote forwards, and a restrict keyword that did not cover tunnel forwarding.

What is still unknown

The official notes do not assign a CVE identifier to the agent-lock interaction. Third-party scanners may catalog one later; do not wait on that number to patch. The project also said it will ship security fixes more often instead of batching them, because AI-assisted reports that look like nothing in a lab are being independently rediscovered by other researchers — including people who do not file bugs.

Watch your distro's openssh package, the portable 10.5p1 tarball SHA256 on the official notes, and whether your MDM or golden image still pins 10.4. If you brief this, lead with the version and the lock-plus-forward combination. That is the decision. The rest is the release notes.