kapsl Index
Docs Releases

openssh

7 tools · 1 release line

Secure remote login, file transfer and key management over SSH. Each tool carries its own sandbox boundary — they are not the same.

kapsl ssh-add
kapsl ssh-agent
kapsl ssh-keygen
kapsl ssh-keyscan
kapsl scp
kapsl sftp
kapsl ssh
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

capabilities differ between them

Tool Capabilities Seccomp Findings Image Description
showing ssh-add ssh-agent ssh-keygen ssh-keyscan scp sftp ssh from openssh@latest → 10.2p1 stable

Findings

C1H1M1L2

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of openssh-add, which ships ssh-add. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H1M1L2

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of openssh-agent, which ships ssh-agent. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H3M3L5

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-86145 ↗ H 8.2 pcre2 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a…
CVE-2026-89161 ↗ H 7.4 pcre2 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
CVE-2026-89158 ↗ M 6.5 pcre2 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
CVE-2026-89157 ↗ M 5.7 pcre2 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-89160 ↗ L 3.7 pcre2 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-89156 ↗ L 2.9 pcre2 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
CVE-2026-89162 ↗ L 2.9 pcre2 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of openssh-keygen, which ships ssh-keygen. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H1M1L2

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of openssh-keyscan, which ships ssh-keyscan. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Findings

M1L2

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

These are the findings of openssh-scp, which ships scp. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Findings

M1L2

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

These are the findings of openssh-sftp, which ships sftp. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H3M3L5

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-86145 ↗ H 8.2 pcre2 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a…
CVE-2026-89161 ↗ H 7.4 pcre2 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
CVE-2026-89158 ↗ M 6.5 pcre2 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
CVE-2026-89157 ↗ M 5.7 pcre2 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
CVE-2026-73282 ↗ M 4.8 openssh In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
CVE-2026-89160 ↗ L 3.7 pcre2 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
CVE-2026-73281 ↗ L 3.5 openssh In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys.
CVE-2026-89156 ↗ L 2.9 pcre2 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
CVE-2026-89162 ↗ L 2.9 pcre2 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
CVE-2026-73283 ↗ L 2.5 openssh In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of openssh-ssh, which ships ssh. Other tools in this project ship in different images and carry different findings. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default nothing — stands alone
runtime none — self-contained
composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default nothing — stands alone
runtime none — self-contained
composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default nothing — stands alone
runtime none — self-contained
composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default nothing — stands alone
runtime none — self-contained
composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash, cp
runtime ssh
composes ssh, bash, cp

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash
runtime ssh
composes ssh, bash

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash
runtime none — self-contained
composes bash

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

name openssh-add
platforms
size 8 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name openssh-agent
platforms
size 8 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name openssh-keygen
platforms
size 9 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name openssh-keyscan
platforms
size 8 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name openssh-scp
platforms
size <1 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name openssh-sftp
platforms
size <1 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name openssh-ssh
platforms
size 11 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Sandbox boundary

ssh-add

capabilities

ro

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.ssh

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

ssh-agent

capabilities

ro

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.ssh/agent · writable

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

ssh-keygen

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.ssh · writable

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

ssh-keyscan

capabilities

netro

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

none

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

scp

capabilities

netrw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.ssh
  • ~/.ssh/known_hosts · writable

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

sftp

capabilities

netrw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.ssh
  • ~/.ssh/known_hosts · writable

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

ssh

capabilities

netro

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.ssh
  • ~/.ssh/known_hosts · writable

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

none

none

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

12 findings across this project at latest. Counted once per advisory across every image the project builds.