UBUNTU-CVE-2026-116794: High severity ubuntu/rust-russh vulnerability
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirmrequest hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.65.0
Event History
Frequently Asked Questions
Which deployments are actually exposed to this issue?
Applications using russh versions from 0.50.0-beta.12 through 0.64.x are exposed only if they override Agent::confirm to enforce user approval or another signing policy. Deployments that retain the default always-successful Agent::confirm do not lose an approval check through this regression.
What access does an attacker need to bypass the confirmation requirement?
The attacker must be able to reach the agent socket. This can include a remote system that can access a forwarded agent, and the affected key must remain loaded in the agent after being added with ssh-add -c.
Do any policy checks still apply to signing requests?
Yes. Agent::confirm_request still runs for every signing request, so implementations that enforce authorization checks in that hook remain protected by those checks. The bypass specifically affects the Agent::confirm path.
What can be done before upgrading?
Ensure signing authorization is enforced in Agent::confirm_request rather than relying only on Agent::confirm, and limit access to the agent socket or agent forwarding. Upgrading to russh 0.65.0 fixes the issue.