cURL SSH Agent Auth Leakage via SCP/SFTP
CVE-2025-15224 Published on January 8, 2026

libssh key passphrase bypass without agent set
When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

NVD

Vulnerability Analysis

CVE-2025-15224 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2025-15224. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is an authentification Vulnerability?

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

CVE-2025-15224 has been classified to as an authentification vulnerability or weakness.


Products Associated with CVE-2025-15224

stack.watch emails you whenever new vulnerabilities are published in Haxx Curl or Canonical Ubuntu Linux. Just hit a watch button to start following.

Haxx Curl
 
Canonical Ubuntu Linux
 

Affected Versions

curl:

Exploit Probability

EPSS
0.07%
Percentile
21.84%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.