CVE-1999-0787: The SSH authentication agent follows symlinks via a UNIX domain socket.

Security readout for executives and security teams

An old flaw in the SSH authentication agent let it follow symbolic links to its UNIX domain socket. A local user on the same system could potentially trick the agent into interacting with an unintended file location, undermining the trust boundary the agent relies on. This is a legacy 1999-era issue in SSH 1.x builds; modern OpenSSH is not implicated by this record. Effectively none on modern estates. Only systems still running SSH 1.2.x (Tatu Ylönen's original SSH from the late 1990s) would carry this behavior. Contemporary OpenSSH releases and modern *nix distributions are not covered by this CVE, and the record has no KEV entry. Low priority for any modern environment. Treat as a housekeeping item: verify no legacy SSH 1.x deployments remain. If they do, replacement — not patching — is the appropriate response, since the affected codebase is long out of support. Mitigation focus: Retire any remaining SSH 1.x installations and standardize on a supported OpenSSH release.; Restrict permissions on directories that hold agent sockets (typically /tmp) to prevent symlink attacks by other local users.; Confirm ssh-agent socket paths use per-user, mode 0700 directories as modern OpenSSH already does..

Prepared

Jul 12, 2026, 01:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.