Vulnerability in Rust SSH Client and Server Library by Eugeny

CVE-2026-116794

What is CVE-2026-116794?

The russh library, a Rust-based SSH client and server, contains an authentication bypass vulnerability in its SSH agent protocol implementation. Specifically, the Connection::try_sign function incorrectly handles the SSH_AGENT_CONSTRAIN_CONFIRM request. Instead of requiring user confirmation as intended, it returns a hard-coded success result, allowing malicious processes to authenticate or sign data without proper checks. Although the Agent::confirm_request hook remains functional, implementations that rely on the default permissive behavior of Agent::confirm face significant security risks. This vulnerability has been rectified in version 0.65.0.

References