CVE-2026-116794

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

Summary

The agent server in russh::keys::agent::server never calls Agent::confirm before signing with a key that was added with the confirm constraint. That constraint is SSH_AGENT_CONSTRAIN_CONFIRM (RFC 9987 §5.2.7.2), which is what ssh-add -c sends.

The call was replaced by a hard-coded true in 3e04597 ("Native async traits encore", #455), first released in 0.50.0-beta.12. Every release since, up to and including 0.64.1, signs requests for confirm-constrained keys without asking the Agent implementation. A user who added a key with -c is therefore never asked to confirm.

Details

Connection::try_sign notes that the key needs confirmation, then awaits a ready future instead of the agent (server.rs L348-L360 at v0.64.1):

let agent = if needs_confirm {
    let (agent, ok) = {
        let _pk = key.clone();
        Box::new(futures::future::ready((agent, true)))
    }
    .await;
    if !ok {
        return Ok((agent, false));
    }
    agent
} else {
    agent
};

Before 3e04597 the first statement was let (agent, ok) = agent.confirm(key.clone()).await;.

try_sign was checked in the published crates on crates.io:

• Every russh release from 0.50.0-beta.12 to 0.64.1 (52 versions) has the hard-coded true.
• russh 0.50.0-beta.8 to beta.11 call agent.confirm.
• Earlier russh releases have no agent server. It lived in russh-keys, and no russh-keys release is affected.

Not affected:

• Agent implementations that keep the default confirm, which returns true anyway.
• Checks made in Agent::confirm_request, which is still called with MessageType::Sign for every sign request (L158-L159).
• The agent client, and the SSH client and server.

PoC

1. Add this test to mod test in russh/src/keys/mod.rs. It uses the module's existing Incoming helper and ED25519_KEY.
2. Run cargo test -p russh --lib keys::test::test_agent_confirms_keys_added_with_the_confirm_constraint.

#[tokio::test]
#[cfg(unix)]
async fn test_agent_confirms_keys_added_with_the_confirm_constraint() {
    use std::sync::atomic::{AtomicUsize, Ordering};

    // An agent whose user refuses every confirmation prompt.
    #[derive(Clone)]
    struct Refuse(std::sync::Arc<AtomicUsize>);
    impl agent::server::Agent for Refuse {
        fn confirm(
            self,
            _: std::sync::Arc<PrivateKey>,
        ) -> Box<dyn Future<Output = (Self, bool)> + Send + Unpin> {
            self.0.fetch_add(1, Ordering::SeqCst);
            Box::new(futures::future::ready((self, false)))
        }
    }

    let prompts = std::sync::Arc::new(AtomicUsize::new(0));
    let dir = tempfile::tempdir().unwrap();
    let agent_path = dir.path().join("agent");
    let mut listener = tokio::net::UnixListener::bind(&agent_path).unwrap();
    let agent = Refuse(prompts.clone());
    tokio::spawn(async move {
        agent::server::serve(
            Incoming {
                listener: &mut listener,
            },
            agent,
        )
        .await
    });

    let key = decode_secret_key(ED25519_KEY, Some("blabla")).unwrap();
    let public = key.public_key().clone();
    let stream = tokio::net::UnixStream::connect(&agent_path).await.unwrap();
    let mut client = agent::client::AgentClient::connect(stream);
    // What `ssh-add -c` sends.
    client
        .add_identity(&key, &[agent::Constraint::Confirm])
        .await
        .unwrap();

    let signed = client
        .sign_request(&AgentIdentity::from(public), None, b"data".to_vec())
        .await;
    let confirm_calls = prompts.load(Ordering::SeqCst);
    assert!(
        signed.is_err(),
        "the agent signed with a…

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.

Summary

The agent server in russh::keys::agent::server never calls Agent::confirm before signing with a key that was added with the confirm constraint. That constraint is SSH_AGENT_CONSTRAIN_CONFIRM (RFC 9987 §5.2.7.2), which is what ssh-add -c sends.

The call was replaced by a hard-coded true in 3e04597 ("Native async traits encore", #455), first released in 0.50.0-beta.12. Every release since, up to and including 0.64.1, signs requests for confirm-constrained keys without asking the Agent implementation. A user who added a key with -c is therefore never asked to confirm.

Details

Connection::try_sign notes that the key needs confirmation, then awaits a ready future instead of the agent (server.rs L348-L360 at v0.64.1):

let agent = if needs_confirm {
    let (agent, ok) = {
        let _pk = key.clone();
        Box::new(futures::future::ready((agent, true)))
    }
    .await;
    if !ok {
        return Ok((agent, false));
    }
    agent
} else {
    agent
};

Before 3e04597 the first statement was let (agent, ok) = agent.confirm(key.clone()).await;.

try_sign was checked in the published crates on crates.io:

• Every russh release from 0.50.0-beta.12 to 0.64.1 (52 versions) has the hard-coded true.
• russh 0.50.0-beta.8 to beta.11 call agent.confirm.
• Earlier russh releases have no agent server. It lived in russh-keys, and no russh-keys release is affected.

Not affected:

• Agent implementations that keep the default confirm, which returns true anyway.
• Checks made in Agent::confirm_request, which is still called with MessageType::Sign for every sign request (L158-L159).
• The agent client, and the SSH client and server.

PoC

1. Add this test to mod test in russh/src/keys/mod.rs. It uses the module's existing Incoming helper and ED25519_KEY.
2. Run cargo test -p russh --lib keys::test::test_agent_confirms_keys_added_with_the_confirm_constraint.

#[tokio::test]
#[cfg(unix)]
async fn test_agent_confirms_keys_added_with_the_confirm_constraint() {
    use std::sync::atomic::{AtomicUsize, Ordering};

    // An agent whose user refuses every confirmation prompt.
    #[derive(Clone)]
    struct Refuse(std::sync::Arc<AtomicUsize>);
    impl agent::server::Agent for Refuse {
        fn confirm(
            self,
            _: std::sync::Arc<PrivateKey>,
        ) -> Box<dyn Future<Output = (Self, bool)> + Send + Unpin> {
            self.0.fetch_add(1, Ordering::SeqCst);
            Box::new(futures::future::ready((self, false)))
        }
    }

    let prompts = std::sync::Arc::new(AtomicUsize::new(0));
    let dir = tempfile::tempdir().unwrap();
    let agent_path = dir.path().join("agent");
    let mut listener = tokio::net::UnixListener::bind(&agent_path).unwrap();
    let agent = Refuse(prompts.clone());
    tokio::spawn(async move {
        agent::server::serve(
            Incoming {
                listener: &mut listener,
            },
            agent,
        )
        .await
    });

    let key = decode_secret_key(ED25519_KEY, Some("blabla")).unwrap();
    let public = key.public_key().clone();
    let stream = tokio::net::UnixStream::connect(&agent_path).await.unwrap();
    let mut client = agent::client::AgentClient::connect(stream);
    // What `ssh-add -c` sends.
    client
        .add_identity(&key, &[agent::Constraint::Confirm])
        .await
        .unwrap();

    let signed = client
        .sign_request(&AgentIdentity::from(public), None, b"data".to_vec())
        .await;
    let confirm_calls = prompts.load(Ordering::SeqCst);
    assert!(
        signed.is_err(),
        "the agent signed with a…

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.