Threats tagged 'rustsec-2026-0495'

The russh SSH agent server incorrectly bypassed user confirmation for keys added with the confirm constraint between versions 0.50.0-beta.12 and before 0.65.0. This flaw allowed any process with access to the agent, including remote hosts via agent forwarding, to sign with protected keys without user approval. The issue was fixed in version 0.65.0, which properly calls the confirmation function and refuses signing if confirmation is denied.