Description
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.
Published: 2026-10-28
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Unauthorized signing and authentication using SSH keys marked for confirmation
Action: Immediate Patch
AI Analysis

Impact

This bug in the russh SSH library causes the agent server to skip the required confirmation step for keys added with the confirm constraint (ssh-add -c). The result is that any process able to interact with the agent socket—such as an attacker who can reach the local socket or exploit a forwarded agent—can sign data or authenticate as the user without the intended authorization check. The flaw is a classic authorization bypass (CWE‑862) and allows an adversary to effectively use the victim’s private keys without consent.

Affected Systems

The vulnerability affects the russh library provided by Eugeny. Versions from 0.50.0‑beta.12 up through 0.65.0 are impacted due to the incomplete confirm handling in the agent server code.

Risk and Exploitability

With a CVSS score of 8.3, this issue poses a high‑risk path for privilege escalation or unauthorized access. The EPSS score is not available, but the vulnerability is not currently listed in the CISA KEV catalog. If an attacker can bind to or otherwise reach the SSH agent socket—directly or via forwarded agent—a signing request can be made that bypasses the confirmation policy. The risk is heightened in environments that enforce strict key confirmation for sensitive operations.

Generated by OpenCVE AI on October 28, 2026 at 18:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade your russh library to version 0.65.0 or later to restore proper confirmation logic.
  • If you override Agent::confirm for custom policy, ensure that the override remains active after the update and that the confirmation hook is still invoked for each signing request.
  • Restrict access to the SSH agent socket and disable agent forwarding unless absolutely necessary, limiting the attack surface for this bypass.

Generated by OpenCVE AI on October 28, 2026 at 18:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Eugeny
Eugeny russh
Vendors & Products Eugeny
Eugeny russh

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.
Title russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Eugeny Russh
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T17:06:57.542Z

Reserved: 2026-10-26T21:53:35.168Z

Link: CVE-2026-116794

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-28T18:17:14.127

Modified: 2026-10-28T18:17:14.260

Link: CVE-2026-116794

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T19:00:18Z

Weaknesses