russh CVE-2026-116794 (GHSA-vp5q-ff62-jwqv): the russh SSH agent server signs with keys added via 'ssh-add -c' without ever asking for confirmation. Which versions are affected and what do I do?

What it is: A high-severity advisory published 2026-10-30 for russh, the Rust SSH library. When you add a key to an SSH agent with ssh-add -c, the agent should ask you to confirm every time the key is used, which protects you if a server you're forwarding your agent to tries to use your key. In russh's agent server the confirmation call had been replaced by a hard-coded 'yes' since 0.50.0-beta.12, so keys added with the confirm constraint were used without asking. Apps that use russh as their SSH agent (some terminal and SSH client apps) silently lost that protection. Am I affected: - You build software with the russh crate below 0.65 and use its agent server (russh::keys::agent::server), or you use an app built on it that acts as your SSH agent. - Check: cargo tree -i russh in your project; for apps, check the vendor's release notes for the russh version or this advisory. - Plain OpenSSH ssh-agent is not affected. Fix: 1. Upgrade the russh dependency to 0.65 or later (update Cargo.toml, cargo update -p russh) and release a new build; app users should update to a version that includes the fix. 2. Until then, avoid agent forwarding (ssh -A / ForwardAgent yes) to servers you don't fully trust when using an affected agent; use ProxyJump instead of forwarding where possible. 3. If you forwarded an affected agent to a server that may be compromised, consider the keys in it as possibly misused: review where they're authorized and rotate them if in doubt. Verify: cargo tree -i russh shows 0.65+, and using a key added with ssh-add -c now triggers a confirmation prompt. Sources: https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv https://github.com/Eugeny/russh/releases/tag/v0.65.0 https://nvd.nist.gov/vuln/detail/CVE-2026-116794