CVE-2026-68930: Eugeny Russh channel-scoped callback bypass for unopened channels

CVE-2026-68930 · Severity: medium · CVSS 6.5 · Published 2026-08-03

Russh, a Rust-based SSH library, fails to verify if a communication channel is actually open before processing requests. This allows an authenticated user to bypass security policies that are supposed to restrict access to specific features like command execution or file transfers. In practice, an attacker could trigger sensitive operations (such as running scripts or accessing internal workflows) even if the server had explicitly denied their request to open a session.

Technologies: russh (crates.io), Eugeny Tabby. Vendors: crates.io, Eugeny.

Quick answers

Is CVE-2026-68930 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68930 being exploited in the wild.
How severe is CVE-2026-68930?
Medium severity, with a CVSS score of 6.5, published 3 August 2026.
Which products and versions are affected?
russh (crates.io) SEMVER:introduced=0,fixed=0.62.5; Eugeny Tabby <= 0.62.4.
Is there a fix for CVE-2026-68930?
Yes. russh (crates.io): upgrade to 0.62.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68930 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68930?
Check whether you run russh (crates.io) or Eugeny Tabby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • russh (crates.io): upgrade to 0.62.5 or later
    cargo update -p russh

Technical details

A logic flaw in `server_read_authenticated` within `russh/src/server/encrypted.rs` allows channel-scoped messages (e.g., SSH_MSG_CHANNEL_REQUEST, CHANNEL_DATA) to be dispatched to handler callbacks without verifying if the recipient ChannelId exists in the established channel table. An authenticated attacker can send crafted packets for arbitrary channel IDs to trigger callbacks such as `exec_request`, `shell_request`, or `subsystem_request` even if `channel_open_session` was never called or returned `false`. Additionally, `server_handle_channel_open` incorrectly retains application-side channel references for denied opens. The vulnerability is addressed in version 0.62.5 by ensuring the recipient channel is confirmed in the encrypted session's channel table before dispatching callbacks.

Affected products

  • Eugeny russh <= 0.62.4

Identifiers

  • CVE-2026-68930
  • GHSA-m65r-rprj-r5rg

Timeline

  • 2026-07-31: disclosed
  • 2026-08-03: advisory
  • 2026-08-03: patched: Fixed in version 0.62.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.