CVE-2026-68930: russh Channel-Scoped Callback Bypass Vulnerability
Summary
CVE-2026-68930: Russh: Channel-scoped server callbacks can be reached without an open channel. Affects russh versions < 0.62.5. Fixed in 0.62.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
russh is a Rust library that implements the SSH protocol, allowing secure communication between clients and servers. It provides functionalities for authentication, session management, and data transfer. This library is widely used in applications requiring secure shell access and remote command execution. However, it has a vulnerability that allows authenticated clients to bypass channel-open policies, potentially leading to unauthorized command execution.
Vulnerability Detail
The vulnerability in russh arises from a server-side channel state issue where authenticated clients can trigger channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. This occurs because the SSH channel lifecycle is not enforced before delivering callbacks to the application. As a result, a malicious authenticated peer can send requests for arbitrary recipient channel IDs, causing sensitive operations to execute without a valid channel context. This vulnerability does not constitute an authentication bypass, as a valid login is still required, but it undermines the intended channel management policies.
How To Fix
Latest published version: 0.64.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.62.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate that a channel is established before processing any channel-scoped requests. This can be done by modifying the request handling logic to ensure that the recipient channel ID exists in the confirmed channel table before invoking any handler callbacks.
Conclusion
CVE-2026-68930 is a significant vulnerability in the russh library that allows authenticated clients to bypass channel management policies, leading to potential unauthorized command execution. It is crucial to update to the patched version to secure your application and prevent exploitation.
See every vulnerability recorded for russh →
FAQ
CVE-2026-68930 is a vulnerability in the russh library that allows authenticated clients to bypass channel-open policies, potentially leading to unauthorized command execution.
If your application uses russh and does not enforce channel lifecycle checks, authenticated users may exploit this vulnerability to execute commands without proper channel context.
You should update to russh version 0.62.5 or later to mitigate this vulnerability. Ensure to test your application after the update.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your Cargo.lock file. You can check your application at Vulert Scanner.
The CVSS score for CVE-2026-68930 is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for russh.
