Read the docs
TI-2026-34333 Aliases CVE-2026-46705GHSA-hpv4-5h6f-wqr3

russh server userauth state is not reset when authentication principal changes

Priority MEDIUM 63CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed russh (Eugeny): 0.61.0russh (crates.io): 0.61.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eugenyrussh0.34.0-beta.1 to before 0.61.00.61.0Patch availableCNA
—russh (crates.io)0.34.0-beta.1 to before 0.61.00.61.0Patch availableGHSA-hpv4-5h6f-wqr3
  • russh VendorEugeny Affected 0.34.0-beta.1 to before 0.61.0 Fixed in 0.61.0 Patch available CNA
  • russh (crates.io) Vendor— Affected 0.34.0-beta.1 to before 0.61.0 Fixed in 0.61.0 Patch available GHSA-hpv4-5h6f-wqr3

Remediation

  • Fix · CNA russh (Eugeny) Fixed in 0.61.0
  • Fix · GHSA-hpv4-5h6f-wqr3 russh (crates.io) Fixed in 0.61.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46705
  2. 2026-10-03 Alias added: GHSA-hpv4-5h6f-wqr3

References

Advisory 1

Other 2

  • TI-2026-65512 russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened CVSS 3.1HIGH 7.5
  • TI-2026-35550 Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds CVSS 3.1HIGH 7.5
  • TI-2026-34331 Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets CVSS 3.1HIGH 7.5
  • TI-2026-34308 Resource allocation without limits in Eugeny russh CVSS 3.1HIGH 7.5
  • TI-2025-16084 Tabby has a TCC Bypass via Misconfigured Node Fuses CVSS 4.0HIGH 8.6
  • TI-2024-36991 Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby CVSS 4.0HIGH 8.6
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences