CVE-2026-116794— russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

Quick assessment

Affected

Eugeny russh

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

russh 是一个用 Rust 编写的 SSH 客户端与服务端库，其中实现了 SSH 代理协议。在版本 0.50.0-beta.12 到 0.65.0 之间，位于 russh/src/keys/agent/server.rs 的代理服务器路径虽然识别了标志，却返回了硬编码的成功结果，而未调用方法。在那些通过重写以要求用户确认或执行其他策略检查的应用程序中，任何能够访问代理套接字（包括转发代理的远程端）的进程，均可使用通过添加的密钥，绕过上述检查，从而以用户身份进行身份验证或签署数据，且该密钥在加载期间持

CVSS 8.3 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1552.004 · Private Keys T1021.004 · SSH

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Eugeny	russh	`< 0.65`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

Source: CVE Program / CVE List V5

Vulnerability Description

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Eugeny	russh	< 0.65	-

II. Public POCs for CVE-2026-116794

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116794

请登录查看更多情报信息。

Other References for CVE-2026-116794 (3)

https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826 x_refsource_MISC
https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116794

IV. Related Vulnerabilities

Same product: russh

Same vendor: Eugeny

Same weakness: CWE-862