CVE-2025-15224

libssh key passphrase bypass without agent set

View on CVE.org
Published Jan 8, 2026 CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Description
When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate using
a locally running SSH agent.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-8062-1 curl vulnerabilities
Ubuntu USN Ubuntu USN USN-8062-2 curl vulnerabilities
History
Type Values Removed Values Added
First Time appeared Haxx
Haxx curl
CPEs cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
Vendors & Products Haxx
Haxx curl
Type Values Removed Values Added
First Time appeared Curl
Curl curl
Vendors & Products Curl
Curl curl
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-287
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
References
Type Values Removed Values Added
Description When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.
Title libssh key passphrase bypass without agent set
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
curl
Published
Updated
Sep 15, 2026, 6:02 AM
Reserved
Dec 28, 2025, 10:49 PM

View source JSON

Updated
Jan 8, 2026, 11:06 AM

JSON

Status
Modified
Published
Jan 8, 2026, 10:15 AM
Modified
Oct 14, 2026, 7:10 PM

View source JSON

No data.

Updated
Jan 9, 2026, 1:25 PM

JSON