UBUNTU-CVE-2026-116794

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-116794
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116794.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-116794
Upstream
Published
2026-11-03T00:00:00Z
Modified
2026-11-04T03:30:34Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

References

Affected packages

Ubuntu:26.10 / rust-russh

Package

Name
rust-russh
Purl
pkg:deb/ubuntu/rust-russh?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.57.1-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "librust-russh-dev",
            "binary_version": "0.57.1-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116794.json"