{"id":"CVE-2026-116794","kind":"vulnerability","aliases":["CVE-2026-116794"],"related":[],"title":"russh: SSH agent server skips per-key confirmation, letting unapproved signing","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.","summary":"russh, a Rust SSH client and server library, has an SSH agent server that accepts keys added with the confirm constraint but never runs the application's confirm check. A process that can reach the agent socket, including a remote host using forwarded agent access, can sign with such a key without the approval the application meant to require.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","russh","rust","self-hosted","ssh-agent"],"not_affected_if":["default-confirm","no-agent-server"],"how_to_check":"- Check the russh version in Cargo.lock: `grep -A1 'name = \"russh\"' Cargo.lock`\n- Check whether the application implements a custom `Agent::confirm` in russh's agent server code","fix":"- Upgrade russh to `0.65.0` or later\n- Until upgraded, implement the approval logic in `Agent::confirm_request`, which still runs for every signing request","status":"open","published_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:34:50+00:00","updated_at":"2026-10-28T18:34:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:34:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade russh to `0.65.0` or later\n- Until upgraded, implement the approval logic in `Agent::confirm_request`, which still runs for every signing request","reach":"network","title":"russh: SSH agent server skips per-key confirmation, letting unapproved signing","impact":"high","summary":"russh, a Rust SSH client and server library, has an SSH agent server that accepts keys added with the confirm constraint but never runs the application's confirm check. A process that can reach the agent socket, including a remote host using forwarded agent access, can sign with such a key without the approval the application meant to require.","category":"package","nicknames":[],"who_cares":["rust","russh","ssh-agent","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker signs or authenticates as user with confirm-protected keys","analyst_note":"Sources list only NVD; confirm the exact attack preconditions for forwarded agent access and whether any advisory or patch notes exist.","how_to_check":"- Check the russh version in Cargo.lock: `grep -A1 'name = \"russh\"' Cargo.lock`\n- Check whether the application implements a custom `Agent::confirm` in russh's agent server code","needs_analyst":true,"not_affected_if":["default-confirm","no-agent-server"],"who_is_affected":"Applications that use russh's SSH agent server and override `Agent::confirm` to require user approval or another policy check are exposed, and the flaw applies to versions from `0.50.0-beta.12` up to `0.65.0`. Applications that keep the default always-successful `Agent::confirm` lose no approval check through this regression, and applications that do not run the agent server are unaffected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3513,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116794':15A,18A '-2026':14A,17A '0.50.0':104C '0.65.0':107C,237C 'accept':42B 'access':72B 'add':44B,170C,174C 'agent':3A,27B,39B,63B,71B,100C,109C,120C,134C,140C,156C,165C,195C,220C 'alway':218C 'always-success':217C 'anoth':147C 'applic':53B,83B,137C 'approv':81B,145C,226C 'authent':181C 'beta.12':105C 'c':175C 'call':133C 'check':56B,149C,178C,206C,227C 'client':32B,92C 'code':128C 'confirm':9A,47B,55B,122C,135C,141C,196C,221C 'connect':112C 'constrain':121C 'constraint':48B 'cve':13A,16A 'data':184C 'default':216C 'effect':210C 'everi':202C 'fix':234C 'forward':70B,164C 'hard':127C 'hard-cod':126C 'hook':198C 'host':24B,68B 'implement':102C,207C,212C 'includ':65B,97C,158C 'instead':131C 'issu':232C 'key':8A,43B,78B,169C,190C 'let':10A 'librari':35B,95C 'load':192C 'lose':224C 'meant':84B 'never':50B 'overrid':139C 'packag':19B 'path':115C 'per':7A 'per-key':6A 'polici':148C 'process':58B,151C 'protocol':101C 'reach':61B,154C 'recogn':118C 'regress':230C 'remain':191C,209C 'remot':67B,160C 'request':197C,204C 'requir':86B,143C 'result':130C 'retain':214C 'return':124C 'run':51B,200C 'russh':1A,20B,28B,87C 'russh/src/keys/agent/server.rs':117C 'rust':21B,30B,90C 'self':23B 'self-host':22B 'separ':194C 'server':4A,34B,40B,94C,110C 'side':161C 'sign':12A,74B,114C,183C,203C 'skip':5A 'socket':64B,157C 'ssh':2A,26B,31B,38B,91C,99C,119C,173C 'ssh-add':172C 'ssh-agent':25B 'still':199C 'success':129C,219C 'tri':113C 'unapprov':11A 'use':69B,167C 'user':144C,187C 'version':236C 'without':79B,176C","nicknames":[],"mitigations":[],"who_affected":"Applications that use russh's SSH agent server and override `Agent::confirm` to require user approval or another policy check are exposed, and the flaw applies to versions from `0.50.0-beta.12` up to `0.65.0`. Applications that keep the default always-successful `Agent::confirm` lose no approval check through this regression, and applications that do not run the agent server are unaffected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116794","severity":null,"published_at":"2026-10-28T18:17:14+00:00","modified_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}