In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssh-9.9p1-13.el9 build changelog.

  - Fix information disclosure and data corruption via use-after-free in ssh client (CVE-2026-73282)

  - Fix misinteraction between agent locking and the session-bind@openssh.com extension (CVE-2026-73281)

  - Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options     (CVE-2026-73283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssh-9.9p1-12.el9 build changelog.

  - In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over     PermitTunnel=yes, but did not. (CVE-2026-59999)

  - sftp client allows attacker to control downloaded file location (CVE-2026-59995)

  - Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-73283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSH installed on the remote host is prior to 10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.5 advisory.

  - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of     remote-forwarding operations are concurrent. (CVE-2026-73282)

  - In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only     locally, including operations that add tokens or use keys. This is caused by misinteraction between agent     locking and the session-bind@openssh.com extension. (CVE-2026-73281)

  - In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to     tunnel forwarding but was not. (CVE-2026-73283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to     tunnel forwarding but was not. (CVE-2026-73283)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339711	CentOS 9 : openssh-9.9p1-13.el9	Nessus	CentOS Local Security Checks	Local	medium
337899	CentOS 9 : openssh-9.9p1-12.el9	Nessus	CentOS Local Security Checks	Local	high
335161	OpenSSH < 10.5 Multiple Vulnerabilities	Nessus	Misc.	Remote	medium
334912	Linux Distros Unpatched Vulnerability : CVE-2026-73283	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-73283

low

Tenable Plugins

medium

high

medium

low