PT-2026-67442 · Russh · Russh
CVE-2026-68930
·
Published
2026-08-03
·
Updated
2026-08-03
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
russh versions prior to 0.62.5
Description
An issue exists in the server-side channel state management where the library dispatches channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. This allows an authenticated client to bypass the server application's channel-open policy. Specifically, in the
server read authenticated function within russh/src/server/encrypted.rs, channel-scoped messages are decoded and dispatched without verifying if the recipient channel is established in the encrypted session's channel table.This behavior affects several callbacks, including
exec request(), shell request(), subsystem request(), pty request(), x11 request(), env request(), agent request(), window change request(), and signal(), as well as CHANNEL DATA, CHANNEL EXTENDED DATA, CHANNEL EOF, and CHANNEL CLOSE messages. A malicious authenticated peer can send crafted SSH MSG CHANNEL REQUEST packets for arbitrary recipient channel IDs to trigger these handlers even if the application denied the channel-open request or if no request was ever sent.Recommendations
Update russh to version 0.62.5.
As a temporary mitigation, restrict the use of the
exec request() function and other channel-scoped callbacks until the update is applied.Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Russh