# CVE-2023-28531: OpenSSH ssh-add destination constraint bypass for smartcard keys

Source: https://junglewise.ai/threats/cve-2023-28531-openssh-ssh-add-destination-constraint-bypass-for-smartcard-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-17. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2023-28531 · Severity: critical · CVSS 9.8 · Published 2023-03-17

OpenSSH, a widely used tool for secure remote access, contains a flaw in how it handles smartcard security keys. When users attempt to apply specific security restrictions to these keys (limiting where they can be used), a logic error causes those restrictions to be ignored. This could allow a compromised intermediate server to use the security key in ways the user did not intend, potentially leading to unauthorized access across a network.

Technologies: [NetApp Hci Bootstrap Os](https://junglewise.ai/threats/technologies/hci-bootstrap-os), [OpenBSD Openssh](https://junglewise.ai/threats/technologies/openssh). Vendors: [NetApp](https://junglewise.ai/threats/vendors/netapp), [OpenBSD](https://junglewise.ai/threats/vendors/openbsd).

## Quick answers

**Is CVE-2023-28531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-28531 being exploited in the wild.

**How severe is CVE-2023-28531?** Critical severity, with a CVSS score of 9.8, published 17 March 2023.

**Which products and versions are affected?** OpenBSD OpenSSH 8.9 to 9.2.

**Is there a fix for CVE-2023-28531?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-28531 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-28531?** Check whether you run NetApp Brocade Fabric Operating System, NetApp Hci Bootstrap Os, NetApp Solidfire Element Os or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic error exists in the 'ssh-add' utility of OpenSSH (versions 8.9 through 9.2) when handling smartcard keys via PKCS#11. When a user adds a smartcard key to 'ssh-agent' using the '-h' flag to specify destination constraints, the constraints are not properly communicated to the agent. Consequently, the keys are added to the agent with no restrictions, bypassing the intended security policy that limits key usage to specific network hops. This vulnerability is specific to smartcard/PKCS#11 keys; standard file-based keys are unaffected. The issue is resolved in OpenSSH 9.3.

## Affected products

- OpenBSD OpenSSH 8.9 to 9.2

## Timeline

- 2023-03-15: advisory: OpenSSH 9.3 released fixing the issue
- 2023-03-17: disclosed: NVD publication date

## References

- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/)
- [https://security.gentoo.org/glsa/202307-01](https://security.gentoo.org/glsa/202307-01)
- [https://security.netapp.com/advisory/ntap-20230413-0008/](https://security.netapp.com/advisory/ntap-20230413-0008/)
- [https://www.debian.org/security/2023/dsa-5586](https://www.debian.org/security/2023/dsa-5586)
- [https://www.openwall.com/lists/oss-security/2023/03/15/8](https://www.openwall.com/lists/oss-security/2023/03/15/8)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)

## Related threats

- [OpenSSH password authentication bypass on musl libc without PAM](https://junglewise.ai/threats/cve-2026-123158-sshd-in-openssh-before-10-6p2-on-linux-when-musl-libc-is-used)
- [In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.](https://junglewise.ai/threats/cve-2026-73283-in-sshd-in-openssh-before-10-5-the-restrict-keyword-in-authorized)
- [In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.](https://junglewise.ai/threats/cve-2026-73282-in-ssh-in-openssh-before-10-5-a-use-after-free-for-realloc-data)
- [In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally…](https://junglewise.ai/threats/cve-2026-73281-in-ssh-agent-in-openssh-before-10-5-some-operations-can-occur)
- [OpenSSH use-after-free in ssh client during key re-exchange](https://junglewise.ai/threats/cve-2026-60002-openssh-use-after-free-in-ssh-client-during-key-re-exchange)