CVE-2026-116794 Eugeny CVE debrief

Who should care

Defenders responsible for systems and applications using the russh library, especially those utilizing SSH keys with the confirm constraint, should be aware of this vulnerability and take necessary actions to verify their inventory and monitor for suspicious activities.

Why it matters

The russh library vulnerability could lead to unintended signing without user confirmation, potentially impacting the security of systems and applications using the library.

• Defenders need to verify their inventory of systems and applications using the russh library to identify potential exposure.
• Monitoring for suspicious signing activities is crucial to detect potential exploitation.
• Updating the library to a fixed version is essential to prevent unintended signing without user confirmation.
• Reviewing SSH key configurations and usage can help mitigate potential risks.

Technical summary

The russh library's agent server fails to call `Agent::confirm` for keys added with the confirm constraint, potentially leading to unintended signing without user confirmation. This issue affects versions 0.50.0-beta.12 to 0.64.1. The vulnerability arises from the `Connection::try_sign` function, which notes that the key needs confirmation but then awaits a ready future instead of the agent. This could potentially lead to security risks if an attacker can exploit this vulnerability to sign requests without user confirmation. Defenders should prioritize verifying their inventory of systems and applications that use the russh library, especially those that utilize SSH keys with the confirm constraint. They should

Defensive priority

Defenders should prioritize verifying their inventory of systems and applications that use the russh library, especially those that utilize SSH keys with the confirm constraint. They should also monitor for any suspicious signing activities and ensure that the library is updated to a version where this issue is fixed.

Recommended defensive actions

• Verify inventory of systems and applications using the russh library
• Monitor for suspicious signing activities
• Update the library to a version where this issue is fixed
• Review SSH key configurations and usage
• Perform a thorough review of the system to identify potential exposure
• Implement additional monitoring to detect potential exploitation
• Review and update incident response plans to address potential security incidents

Evidence notes

The evidence for this vulnerability comes from the official CVE record and the source item provided. The CVE record provides a summary of the vulnerability, while the source item offers detailed information about the issue, including the affected versions and a code snippet demonstrating the problem.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.