CVE-2026-68930 Details
Description
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.
A vulnerability exists in the Russh library, a Rust SSH client and server library, in versions prior to 0.62.5. The issue arises because the server does not properly validate channel IDs for channel-scoped handler callbacks. As a result, an authenticated client can send requests for recipient channel IDs that were never opened or confirmed. This flaw allows the client to bypass the server application's channel-open policy, potentially leading to unauthorized execution of commands or actions that should be restricted.
Users should update to Russh version 0.62.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Eugeny/russh/security/advisories/GHSA-m65r-rprj-r5rg | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/Eugeny/russh/commit/7c5659f8cf6f6f2f9989d12dba0ebf49dc50a171 | [email protected] | Source CodeVendor |
| https://github.com/Eugeny/russh/releases/tag/v0.62.5 | [email protected] | Release NotesVendor |
| https://github.com/Eugeny/russh/security/advisories/GHSA-m65r-rprj-r5rg | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-666 | Operation on Resource in Wrong Phase of Lifetime | [email protected] |
| CWE-696 | Incorrect Behavior Order | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eugeny russh | <= 0.62.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | New CVE Received | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |