CVE-2026-68930
Received Received - Intake

Remote Code Execution in Russh SSH Library

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-68930
EUVD
EUVD-2026-52337

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
russh russh to 0.62.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-696 The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
CWE-666 The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Russh is a Rust SSH client and server library. A vulnerability exists in versions prior to 0.62.5 where the library incorrectly dispatches channel-scoped Handler callbacks for SSH channel IDs that were never opened or confirmed. This flaw is located in russh/src/server/encrypted.rs during server_read_authenticated processing, specifically affecting the exec_request callback.

Impact Analysis

This vulnerability could allow an authenticated attacker to execute unauthorized commands on the server by exploiting unconfirmed channel IDs. The impact includes potential command execution without proper authorization, leading to unauthorized access or control of the affected system.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR or HIPAA by allowing unauthorized access or control over SSH channels due to improper handling of channel IDs. This may lead to data breaches or unauthorized system access, violating confidentiality and integrity requirements.

Mitigation Strategies

Update the Russh library to version 0.62.5 or later to address the channel-scoped Handler callback issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart