PT-2026-33684 · Julia · Openssh Jll

Published 2026-04-09 · Updated 2026-04-09

OSV

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

Related Identifiers

JLSEC-2026-69

Affected Products

Openssh Jll

References · 8

• https://debian.org/security/2023/dsa-5586 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-69 · Vendor Advisory
• https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b · Note
• https://security.netapp.com/advisory/ntap-20240105-0005 · Note
• https://openwall.com/lists/oss-security/2023/12/18/2 · Note
• https://support.apple.com/kb/HT214084 · Note
• https://openssh.com/txt/release-9.6 · Note
• http://seclists.org/fulldisclosure/2024/Mar/21 · Note