CVE-2025-15224 libssh key passphrase bypass without agent set

🗓️ 08 Jan 2026 10:08:27Reported by GoogleType

osv🔗 osv.dev👁 5 Views

During Secure Copy or Secure File Transfer Protocol transfers, curl wrongly prompts for public key authentication and uses a local Secure Shell agent.

Reporter	Title	Published	Views	Family All 120
FreeBSD	curl -- Multiple vulnerabilities	6 Jan 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl (CVE-2025-14819, CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, CVE-2026-5545)	26 Jun 202615:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images	18 May 202616:50	–	ibm
Tenable Nessus	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-1375)	19 Feb 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : curl, --advisory ALAS2-2026-3173 (ALAS-2026-3173)	19 Feb 202600:00	–	nessus
Tenable Nessus	Curl 7.58.0 < 8.18.0 Multiple Vulnerabilities	19 Jan 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-1232)	10 Mar 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP13 : curl (EulerOS-SA-2026-1268)	10 Mar 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1305)	16 Mar 202600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1331)	16 Mar 202600:00	–	nessus

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/01/07/7
curl	www.curl.se/docs/CVE-2025-15224.html
curl	www.curl.se/docs/CVE-2025-15224.json
hackerone	www.hackerone.com/reports/3480925
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15224.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-15224

08 Jul 2026 06:20Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.13.1

EPSS0.00413