RHSA-2026:70719MediumCVSS 5.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 23, 2026
Last Modified
October 6, 2026

🔗 CVE IDs covered (3)

CVE-2026-73281 →CVE-2026-73282 →CVE-2026-73283 →

📋 Description

CVE-2026-73281 — openssh: OpenSSH: ssh-agent allows remote execution of local operations CVE-2026-73282 — openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client CVE-2026-73283 — openssh: OpenSSH: Tunnel forwarding restriction bypass

🎯 Affected products16

  • Red Hat Hardened Images
  • openssh-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.hum1@src as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Avoid using ssh-agent forwarding to untrusted remote hosts, or disable agent forwarding entirely by removing `ForwardAgent yes` from SSH configuration. If agent forwarding is required, avoid locking the agent while forwarded sessions are active. Workaround: Avoid issuing dynamic remote-forwarding commands over active SSH multiplexing connections, or disable socket multiplexing by setting ControlMaster no in ~/.ssh/config. Workaround: Set PermitTunnel no in /etc/ssh/sshd_config to disable TUN/TAP tunnel forwarding server-wide. Alternatively, restrict tunnel permissions for specific users or groups using Match blocks in sshd_config or explicit no-tun directives in authorized_keys.

🔗 References (7)