CVE-2026-116794

The russh Rust SSH library (versions 0.50.0-beta.12 through 0.65.0 ) contains a vulnerability in its SSH agent protocol implementation. Specifically, the Connection::try_sign path in russh/src/keys/agent/server.rs recognizes the SSH_AGENT_CONSTRAIN_CONFIRM flag but returns a hard-coded success re...

CVE-2026-116794 russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...