CVE-2026-46705

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0.

• CWE-287

• https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3
• https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46699conda-smithy is a tool for combining a conda recipe with con…7.6
• CVE-2026-4670Authentication bypass by primary weakness vulnerability in P…9.8
• CVE-2026-46700Actual is a local-first personal finance tool. Prior to 26.6…4.3
• CVE-2026-46701Network-AI is a TypeScript/Node.js multi-agent orchestrator.…7.6
• CVE-2026-46702Russh is a Rust SSH client & server library. From version 0.…7.5
• CVE-2026-46703Boxlite is a sandbox service that allows users to create lig…9.6
• CVE-2026-46709Tabby (formerly Terminus) is a highly configurable terminal …7.8
• CVE-2026-46710Notepad++ is a free and open-source source code editor. From…7.8
• CVE-2026-46712Misskey is an open source, federated social media platform. …2.3
• CVE-2026-46713Misskey is an open source, federated social media platform. …9.2
• CVE-2026-46714Misskey is an open source, federated social media platform. …5.1
• CVE-2026-46715Flask-Security-Too allows users to add security features to …5.3