{"id":"CVE-2023-38408","title":"The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system","summary":"The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-428","CWE-428"],"vendor":"openbsd","product":"openssh","affected":["openssh < 9.3","openssh = 9.3","fedora = 37","fedora = 38"],"patched":["openssh 9.3"],"published":"2023-07-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T00:16:34.667","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-38408","references":[{"url":"http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2023/07/20/1","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2023/07/20/2","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2023/09/22/11","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2023/09/22/9","label":"cve@mitre.org"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent","label":"cve@mitre.org"},{"url":"https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8","label":"cve@mitre.org"},{"url":"https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d","label":"cve@mitre.org"},{"url":"https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/","label":"cve@mitre.org"},{"url":"https://news.ycombinator.com/item?id=36790196","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202307-01","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20230803-0010/","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT213940","label":"cve@mitre.org"},{"url":"https://www.openssh.com/security.html","label":"cve@mitre.org"},{"url":"https://www.openssh.com/txt/release-9.3p2","label":"cve@mitre.org"},{"url":"https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt","label":"cve@mitre.org"},{"url":"https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408","label":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/07/20/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/07/20/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/09/22/11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/09/22/9","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://news.ycombinator.com/item?id=36790196","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202307-01","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20230803-0010/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213940","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openssh.com/security.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openssh.com/txt/release-9.3p2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","exploit-available"],"epss":0.797,"epssPercentile":0.99604,"exploits":{"github":10,"githubRepos":["https://github.com/kali-mx/CVE-2023-38408","https://github.com/LucasPDiniz/CVE-2023-38408","https://github.com/classic130/CVE-2023-38408"],"checkedAt":"2026-10-15T01:08:37.768Z"},"exploitAvailable":true,"ingestedAt":"2026-10-15T01:08:04.204Z","slug":"CVE-2023-38408","body":"## Overview\n\nThe PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.\n\n## Affected\n\n- `openssh < 9.3`\n- `openssh = 9.3`\n- `fedora = 37`\n- `fedora = 38`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssh 9.3`","depth":"abyssal","depthScore":82,"depthScoreParts":{"impact":53.9,"likelihood":15.9,"exploitation":12,"ransomware":0},"changes":[]}