Quick answers
- Is CVE-2026-116794 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116794 being exploited in the wild.
- How severe is CVE-2026-116794?
- High severity, with a CVSS score of 4, published 28 October 2026.
- Which products and versions are affected?
- russh (crates.io) < 0.65, ECOSYSTEM:introduced=0,fixed=0.65; Eugeny Russh 0.50.0-beta.12 to 0.65.0.
- Is there a fix for CVE-2026-116794?
- Yes. russh (crates.io): upgrade to 0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116794 attacked?
- It is attacked over the network or from the adjacent network, in a software library.
- Am I affected by CVE-2026-116794?
- Check whether you run russh (crates.io) or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- russh (crates.io): upgrade to 0.65 or later
cargo update -p russh
Technical details
The SSH agent server's Connection::try_sign method in russh/src/keys/agent/server.rs recognizes the SSH_AGENT_CONSTRAIN_CONFIRM flag but returns a hard-coded successful result instead of calling the Agent::confirm hook. This allows any process that can reach the agent socket to use constrained keys without triggering the required confirmation callback, though the separate Agent::confirm_request hook still executes for every signing request.
Affected products
- Eugeny russh 0.50.0-beta.12 to 0.65.0
Identifiers
- CVE-2026-116794
- GHSA-vp5q-ff62-jwqv
Timeline
- 2026-10-28: disclosed
- 2025-01-27: patched