libssh key passphrase bypass without agent set

The core of this vulnerability lies in curl's mishandling of SSH authentication. When transferring files using SCP or SFTP, curl incorrectly attempts to authenticate using a locally running SSH agent even when public key authentication is requested. This bypass allows an attacker who can control the target system to potentially access files and directories without proper credentials. The impact is particularly severe in environments where SSH keys are used for secure file transfers, as this vulnerability effectively negates the security provided by those keys. Successful exploitation could lead to data exfiltration, modification of sensitive files, or even remote code execution if the transferred files are subsequently executed.

Systems relying on curl for secure file transfers via SCP or SFTP are at risk, particularly those using public key authentication. This includes automated deployment pipelines, backup systems, and any infrastructure where curl is used to transfer sensitive data. Shared hosting environments where users have limited control over the curl configuration are also potentially vulnerable.

• linux / server:

  ps aux | grep curl
  journalctl -u curl | grep "SSH_AUTH_SOCK"

• generic web:

  curl -v https://your-server.com/  # Check for unusual SSH-related headers

1. 2026-01-08Disclosure

   disclosure

1. Reserviert2025-12-28
2. Veröffentlicht2026-01-08
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-15224 is to upgrade to curl version 8.17.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as disabling SCP/SFTP transfers or restricting access to the affected curl instances. WAFs and proxies can be configured to inspect and block suspicious SCP/SFTP requests, but this is not a substitute for patching. There are no specific Sigma or YARA rules available at this time, but monitoring SSH authentication attempts and file transfer activity is recommended.