ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "openssh-client": "1:8.9p1-3ubuntu0.5", "ssh-askpass-gnome-dbgsym": "1:8.9p1-3ubuntu0.5", "openssh-tests": "1:8.9p1-3ubuntu0.5", "openssh-sftp-server-dbgsym": "1:8.9p1-3ubuntu0.5", "ssh-askpass-gnome": "1:8.9p1-3ubuntu0.5", "openssh-sftp-server": "1:8.9p1-3ubuntu0.5", "openssh-server": "1:8.9p1-3ubuntu0.5", "openssh-tests-dbgsym": "1:8.9p1-3ubuntu0.5", "openssh-server-dbgsym": "1:8.9p1-3ubuntu0.5", "ssh": "1:8.9p1-3ubuntu0.5", "openssh-client-dbgsym": "1:8.9p1-3ubuntu0.5" } ], "priority_reason": "Only affects configurations using agent forwarding, smartcard keys, and per-hop destination constraints. Policy bypass only." }