CVE-2023-51384
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied.
Published Dec 18, 2023 · updated Oct 15, 2026 · openbsd openssh
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 18, 2023 · NIST NVD
Detected
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
Oct 15, 2026 · NIST NVD
Updated
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
Affected
- cpe debian/debian linux11.0
- cpe debian/debian linux12.0
- cpe openbsd/opensshversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2023-51384
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2023-51384
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2023-51384
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multipl
nvd.nist.gov