When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate using
a locally running SSH agent.
Metrics
Affected Vendors & Products
References
History
Tue, 20 Jan 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Haxx
Haxx curl |
|
| CPEs | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Haxx
Haxx curl |
Fri, 09 Jan 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Thu, 08 Jan 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 08 Jan 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-287 | |
| Metrics |
cvssV3_1
|
Thu, 08 Jan 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 08 Jan 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. | |
| Title | libssh key passphrase bypass without agent set | |
| References |
|
Status: PUBLISHED
Assigner: curl
Published:
Updated: 2026-01-08T14:39:55.278Z
Reserved: 2025-12-28T22:49:58.556Z
Link: CVE-2025-15224
Updated: 2026-01-08T11:06:23.372Z
Status : Analyzed
Published: 2026-01-08T10:15:47.207
Modified: 2026-01-20T14:47:52.710
Link: CVE-2025-15224
No data.