CVE-2026-68930 Russh: Channel-scoped server callbacks can be reached without an open channel
Attackers can trigger server callbacks for non-existent SSH channels, bypassing channel state checks in the Russh library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68930?
CVE-2026-68930 is a medium-severity missing authorization vulnerability in Eugeny russh, published on 3 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.
Which versions are affected by CVE-2026-68930?
2 open source packages ship an affected version, including russh.
| Package | Affected | Fixed in |
|---|---|---|
russh crates.io | All versions | 0.62.5 |
russh crates.io | All versions | 0.62.5 |
How do I fix CVE-2026-68930?
Upgrade russh to 0.62.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-68930 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-68930 exists.
Sources
Also known as DEBIAN-CVE-2026-68930, GHSA-m65r-rprj-r5rg.