SSH Client and Server Library Vulnerability in Russh by Eugeny

CVE-2026-128088

What is CVE-2026-128088?

The russh SSH client and server library prior to version 0.65.1 contains a flaw in its SSH agent protocol implementation. The issue occurs in the try_sign() function where, after an await on Agent::confirm(), it fails to revalidate the shared lock state and the presence of key material. This defect could allow a remote peer to initiate a signature request while the agent remains unlocked, potentially leading to unintended operations that exploit the stale confirmation state, despite new requests being rejected. This problem, which stems from a prior remediation effort for an earlier issue, was addressed in version 0.65.1.

References