{"id":"GHSA-vp5q-ff62-jwqv","revision":null,"records":[{"revision":"db6333f1d98c48b3bbbddb7692520fd3","observedAt":"2026-10-28T18:46:48.818+00:00","statement":{"source":"cve-program","id":"CVE-2026-116794","aliases":[],"title":"russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.","state":0,"publishedAt":"2026-10-28T17:06:57.542+00:00","modifiedAt":"2026-10-28T17:06:57.542+00:00","affected":[{"ecosystem":"Vendor product","name":"russh","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Eugeny\",\n                    \"product\": \"russh\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.65\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","score":8.3,"severity":"HIGH"}],"references":["https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv","https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826","https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f","https://github.com/Eugeny/russh/releases/tag/v0.65.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116794","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-116794","identifiers":["CVE-2026-116794"]},"retained":false,"historicalAffected":[]},{"revision":"1835e77b993546e388dc0d781049135f","observedAt":"2026-10-30T23:48:11.79+00:00","statement":{"source":"euvd","id":"EUVD-2026-112267","aliases":["CVE-2026-116794"],"title":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAI…","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","score":8.3,"severity":null}],"references":["https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv","https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826","https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f","https://github.com/Eugeny/russh/releases/tag/v0.65.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112267","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 28, 2026, 5:06:57 PM","dateUpdated":"Oct 28, 2026, 5:06:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-112267","identifiers":["EUVD-2026-112267","CVE-2026-116794"]},"retained":false,"historicalAffected":[]},{"revision":"b99ccbf5f000427aaaddc1602cd56392","observedAt":"2026-10-30T23:47:40.018+00:00","statement":{"source":"nvd","id":"CVE-2026-116794","aliases":[],"title":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAI…","description":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.","state":0,"publishedAt":"2026-10-28T18:17:14.127+00:00","modifiedAt":"2026-10-28T18:17:14.26+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.3,"severity":"HIGH"}],"references":["https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826","https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f","https://github.com/Eugeny/russh/releases/tag/v0.65.0","https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116794","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-10-28T18:17:14.127","lastModified":"2026-10-28T18:17:14.260"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-116794","identifiers":["CVE-2026-116794"]},"retained":false,"historicalAffected":[]},{"revision":"7606954e1d624fc895224a94a80954ce","observedAt":"2026-10-30T23:47:35.544+00:00","statement":{"source":"osv","id":"GHSA-vp5q-ff62-jwqv","aliases":["CVE-2026-116794"],"title":"russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation","description":"### Summary\n\nThe agent server in `russh::keys::agent::server` never calls `Agent::confirm` before signing with a key that was added with the confirm constraint. That constraint is `SSH_AGENT_CONSTRAIN_CONFIRM` (RFC 9987 §5.2.7.2), which is what `ssh-add -c` sends.\n\nThe call was replaced by a hard-coded `true` in 3e04597 (\"Native async traits encore\", #455), first released in 0.50.0-beta.12. Every release since, up to and including 0.64.1, signs requests for confirm-constrained keys without asking the `Agent` implementation. A user who added a key with `-c` is therefore never asked to confirm.\n\n### Details\n\n`Connection::try_sign` notes that the key needs confirmation, then awaits a ready future instead of the agent ([server.rs L348-L360 at v0.64.1](https://github.com/Eugeny/russh/blob/e5d80a07dc554480b6ea3b2e14adfc190407b627/russh/src/keys/agent/server.rs#L348-L360)):\n\n```rust\nlet agent = if needs_confirm {\n    let (agent, ok) = {\n        let _pk = key.clone();\n        Box::new(futures::future::ready((agent, true)))\n    }\n    .await;\n    if !ok {\n        return Ok((agent, false));\n    }\n    agent\n} else {\n    agent\n};\n```\n\nBefore [3e04597](https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826) the first statement was `let (agent, ok) = agent.confirm(key.clone()).await;`.\n\n`try_sign` was checked in the published crates on crates.io:\n- Every russh release from 0.50.0-beta.12 to 0.64.1 (52 versions) has the hard-coded `true`.\n- russh 0.50.0-beta.8 to beta.11 call `agent.confirm`.\n- Earlier russh releases have no agent server. It lived in russh-keys, and no russh-keys release is affected.\n\nNot affected:\n- `Agent` implementations that keep the default `confirm`, which returns `true` anyway.\n- Checks made in `Agent::confirm_request`, which is still called with `MessageType::Sign` for every sign request ([L158-L159](https://github.com/Eugeny/russh/blob/e5d80a07dc554480b6ea3b2e14adfc190407b627/russh/src/keys/agent/server.rs#L158-L159)).\n- The agent client, and the SSH client and server.\n\n### PoC\n\n1. Add this test to `mod test` in `russh/src/keys/mod.rs`. It uses the module's existing `Incoming` helper and `ED25519_KEY`.\n2. Run `cargo test -p russh --lib keys::test::test_agent_confirms_keys_added_with_the_confirm_constraint`.\n\n```rust\n#[tokio::test]\n#[cfg(unix)]\nasync fn test_agent_confirms_keys_added_with_the_confirm_constraint() {\n    use std::sync::atomic::{AtomicUsize, Ordering};\n\n    // An agent whose user refuses every confirmation prompt.\n    #[derive(Clone)]\n    struct Refuse(std::sync::Arc<AtomicUsize>);\n    impl agent::server::Agent for Refuse {\n        fn confirm(\n            self,\n            _: std::sync::Arc<PrivateKey>,\n        ) -> Box<dyn Future<Output = (Self, bool)> + Send + Unpin> {\n            self.0.fetch_add(1, Ordering::SeqCst);\n            Box::new(futures::future::ready((self, false)))\n        }\n    }\n\n    let prompts = std::sync::Arc::new(AtomicUsize::new(0));\n    let dir = tempfile::tempdir().unwrap();\n    let agent_path = dir.path().join(\"agent\");\n    let mut listener = tokio::net::UnixListener::bind(&agent_path).unwrap();\n    let agent = Refuse(prompts.clone());\n    tokio::spawn(async move {\n        agent::server::serve(\n            Incoming {\n                listener: &mut listener,\n            },\n            agent,\n        )\n        .await\n    });\n\n    let key = decode_secret_key(ED25519_KEY, Some(\"blabla\")).unwrap();\n    let public = key.public_key().clone();\n    let stream = tokio::net::UnixStream::connect(&agent_path).await.unwrap();\n    let mut client = agent::client::AgentClient::connect(stream);\n    // What `ssh-add -c` sends.\n    client\n        .add_identity(&key, &[agent::Constraint::Confirm])\n        .await\n        .unwrap();\n\n    let signed = client\n        .sign_request(&AgentIdentity::from(public), None, b\"data\".to_vec())\n        .await;\n    let confirm_calls = prompts.load(Ordering::SeqCst);\n    assert!(\n        signed.is_err(),\n        \"the agent signed with a confirm-constrained key without asking: \\\n         Agent::confirm was called {confirm_calls} time(s)\"\n    );\n    assert_eq!(\n        confirm_calls, 1,\n        \"Agent::confirm should be asked exactly once\"\n    );\n}\n```\n\nOn v0.64.1 (e5d80a0) the test fails:\n\n```\nthe agent signed with a confirm-constrained key without asking: Agent::confirm was called 0 time(s)\n```\n\nWith the fix below it passes, and so do all 46 `keys::` tests.\n\n### Impact\n\nA russh-based agent whose `Agent::confirm` asks the user, or applies any other check, signs every request for a confirm-constrained key without running that check. Anyone who can talk to the agent can then use the key without the user's approval:\n- other local processes of the user;\n- the remote host, when the agent is forwarded (`ssh -A`).\n\nPreventing exactly this is the purpose of the confirm constraint. RFC 9987 §10 names it as what stops an attacker with access to the agent from \"stealing use of those keys\".\n\nBecause the agent accepts the constraint, `ssh-add -c` reports success and the user believes the key is protected. RFC 9987 §5.2.7 says an agent that does not support a constraint MUST refuse the key instead.\n\nThe private key itself is not exposed. The impact is unauthorized use of it for as long as the attacker can reach the agent: logging in to other hosts as the user, or signing data such as git commits.\n\n**Known affected downstream user** (from its public code; not tested): Proton Pass desktop, which uses russh 0.62.7.\n- It adds every key with `Constraint::Confirm` ([mod.rs L332](https://github.com/ProtonMail/WebClients/blob/64862561fea883c1b4360b7338a0102eaad5c0fb/applications/pass-desktop/native/napi/src/ssh_agent/mod.rs#L332)).\n- It uses `Agent::confirm` as its \"Pass is unlocked\" check before signing, and defers `MessageType::Sign` from `confirm_request` to it ([L75-L100](https://github.com/ProtonMail/WebClients/blob/64862561fea883c1b4360b7338a0102eaad5c0fb/applications/pass-desktop/native/napi/src/ssh_agent/mod.rs#L75-L100)). That check never runs.\n- Proton also removes keys from the agent on lock and logout ([ssh-agent.middleware.ts L23-L27](https://github.com/ProtonMail/WebClients/blob/64862561fea883c1b4360b7338a0102eaad5c0fb/applications/pass/src/app/Store/ssh-agent.middleware.ts#L23-L27)).\n\nSo the exposure there is limited to states in which keys stay loaded while Pass is not unlocked. Their own code notes, for example, that the agent persists across renderer reloads and account switches.\n\n### Suggested fix\n\n```diff\n--- a/russh/src/keys/agent/server.rs\n+++ b/russh/src/keys/agent/server.rs\n@@ -346,11 +346,7 @@ impl<S: AsyncRead + AsyncWrite + Send + Unpin + 'static, A: Agent + Send + Sync\n             }\n         };\n         let agent = if needs_confirm {\n-            let (agent, ok) = {\n-                let _pk = key.clone();\n-                Box::new(futures::future::ready((agent, true)))\n-            }\n-            .await;\n+            let (agent, ok) = agent.confirm(key.clone()).await;\n             if !ok {\n                 return Ok((agent, false));\n             }\n```\n\nWhen `confirm` returns `false`, `try_sign` returns `false` and the agent answers `SSH_AGENT_FAILURE`, as it did before the regression.\n\n**Compatibility note for the release notes:** `confirm` is called again for confirm-constrained keys, so implementations that stub it out will now hit that stub.\n- For example, Litterbox implements `confirm` as `todo!()` ([agent.rs L81-L87](https://github.com/Gerharddc/Litterbox/blob/c2cc67b80926affecbaa5905a7480af17b1270f2/litterbox/src/agent.rs#L81-L87)).\n- Each connection runs in its own task, so such a panic ends only that connection.\n\n**Related but separate:** with the default `confirm`, the agent still accepts the confirm constraint without enforcing it. Given RFC 9987 §5.2.7, refusing such keys when the application does not implement `confirm` may be worth considering.","state":0,"publishedAt":"2026-10-30T22:59:08+00:00","modifiedAt":"2026-10-30T23:15:08.2809478+00:00","affected":[{"ecosystem":"crates.io","name":"russh","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.65"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv","https://nvd.nist.gov/vuln/detail/CVE-2026-116794","https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826","https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f","https://github.com/Eugeny/russh","https://github.com/Eugeny/russh/releases/tag/v0.65.0"],"sourceUrl":"https://github.com/advisories/GHSA-vp5q-ff62-jwqv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vp5q-ff62-jwqv","identifiers":["GHSA-vp5q-ff62-jwqv","CVE-2026-116794"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-31T02:47:27.2544287+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-31T02:47:27.2544287+00:00","lastSuccessAt":"2026-10-31T02:47:27.412022+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:47:27.4120229+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9266d7b009bf9c4a0ccdcb5cbdea7f905cb3c4d92fd3b41581ece16b2cfdc4e7-d7f5a774da7dc1d7039b507f4f152d095052a9de5600b490bf90aeeb3ccce760","complete":true,"records":417488,"lastAttemptAt":"2026-10-31T02:45:38.6593437+00:00","lastSuccessAt":"2026-10-31T02:45:38.6372337+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:45:38.6593437+00:00","snapshotPublishedAt":"2026-10-31T02:28:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-39149994e3854f27b5e713b62480af55","complete":true,"records":13563,"lastAttemptAt":"2026-10-31T02:47:53.1518029+00:00","lastSuccessAt":"2026-10-31T00:45:56.62+00:00","error":null,"lastVerifiedAt":"2026-10-31T00:45:56.62+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13635,"expectedIdentifiers":13635,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-31T02:47:27.2544287+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-31T02:47:27.2544287+00:00","lastSuccessAt":"2026-10-31T02:47:27.4127685+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:47:27.4127685+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e07ef8e6642e41289c217437d69cabe7","complete":false,"records":13575,"lastAttemptAt":"2026-10-31T02:47:52.572535+00:00","lastSuccessAt":"2026-10-31T02:47:52.568+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:47:52.568+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13635,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-10-31T02:47:27.2108627+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:47:27.2108627+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-31T02:45:38.7086939+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:45:38.7086939+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-10-31T02:47:27.2247414+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:47:27.2247414+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-0d73c5ef3fc1482e9579e6438c4ee3a6c6252dd519f22ac62df687497937bd6c","complete":true,"records":230992,"lastAttemptAt":"2026-10-31T02:47:27.0834272+00:00","lastSuccessAt":"2026-10-31T02:47:25.6622408+00:00","error":null,"lastVerifiedAt":"2026-10-31T02:47:27.0834272+00:00","snapshotPublishedAt":"2026-10-31T02:33:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}