PT-2026-45018 · Eugeny+3 · Russh+1

CVE-2026-46705 · Published 2026-05-29 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Russh versions 0.34.0-beta.1 through 0.60.x

Description The server authentication path in the Russh library fails to separate internal user authentication state when the request principal changes across SSH MSG USERAUTH REQUEST messages. According to RFC 4252, the user name and service name fields may change between authentication requests. In affected versions, internal state—including remaining methods, partial-success state, and in-progress method state—remains associated with the connection. This internal library state mismatch allows authentication state from one principal to influence subsequent requests for a different (user, service) pair. Specifically, the AuthRequest state, which includes methods, partial success, current (tracking in-progress method state), and rejection count, is connection-scoped rather than principal-scoped.

Recommendations Update to version 0.61.0.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-46705

GHSA-HPV4-5H6F-WQR3

Affected Products

Russh

Rust-Russh

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46705.json · Exploit
• 🔥 https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-46705 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46705 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46705 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpv4-5h6f-wqr3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46705 · Security Note
• https://github.com/Eugeny/russh · Note
• https://t.me/CVEtracker/56494 · Telegram Post