CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

• CWE-862

• https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826
• https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f
• https://github.com/Eugeny/russh/releases/tag/v0.65.0
• https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116774russh is a Rust SSH client and server library that includes …4.3
• CVE-2026-116775pageant provides a PageantStream type that implements AsyncR…2.3
• CVE-2026-116776USB Test is a lightweight Windows CLI utility for verifying …7
• CVE-2026-116778FOG is a free open-source cloning/imaging/rescue suite/inven…8.8
• CVE-2026-11678Integer overflow in libyuv in Google Chrome prior to 149.0.7…5.3
• CVE-2026-11679Use after free in Codecs in Google Chrome on Windows prior t…8.3
• CVE-2026-116795RE2JS is the JavaScript port of RE2, a regular expression en…7.5
• CVE-2026-116796Highcharts JS is a JavaScript charting library based on SVG.…7.2
• CVE-2026-116797Highcharts JS is a JavaScript charting library based on SVG.…8.5
• CVE-2026-1168GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2026-11680Use after free in Media in Google Chrome on Windows prior to…8.8
• CVE-2026-116800WWBN AVideo before 29.5.0 contains a local file inclusion vu…6.2