Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
Lead record- Why these records are connected
- Records explicitly naming the same CVE identifier.
- Connection key
cve:CVE-2026-116794- Public snapshot refreshed
- today 19:39 UTC
- Distinct source events
- 6
- Source records represented
- 6
Current snapshot membership is shown here. Source histories and cited revisions remain on each record. Future source targets are labelled separately from observed changes. Browse connections.
Evidence in chronological order
- Wed 28 Oct · Dated source evidence · Newly collected advisory russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116794 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.
- Fri 30 Oct · Dated source evidence · Newly collected advisory russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationGHSA-vp5q-ff62-jwqv Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.
- Sun 1 Nov · Dated source evidence · Advisory content revised russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAI…EUVD-2026-112267 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.
- Fri 6 Nov · Dated source evidence · Advisory content revised russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAI…EUVD-2026-112267 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.
- Thu 12 Nov · Dated source evidence · Advisory content revised russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationGHSA-vp5q-ff62-jwqv Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Advisory content revised; observed by ChangeIntel, not the original publication date.
- Thu 12 Nov · Dated source evidence · Newly collected advisory Agent server signs with confirm-constrained keys without calling `Agent::confirm`RUSTSEC-2026-0495 Source: Derived from the linked evidence · source check: not recorded hereYour review: not selected in your watchlist or stack; no review is inferred.Newly collected advisory; observed by ChangeIntel, not the original publication date.