CVE-2026-68930: 
Rust vulnerability analysis and mitigation

CVE-2026-68930 is a channel lifecycle enforcement vulnerability in russh, a Rust SSH client and server library, titled "Channel-scoped server callbacks can be reached without an open channel." It affects all russh versions up to and including 0.62.4, and was published on July 31, 2026, with the GitHub Advisory Database entry updated on August 3, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/Moderate) (Github Advisory). Version 0.62.5 contains the fix (russh Release).

The root cause lies in server_read_authenticated within russh/src/server/encrypted.rs, where channel-scoped SSH messages (e.g., CHANNEL_REQUEST, CHANNEL_DATA, CHANNEL_EOF, CHANNEL_CLOSE) are decoded and dispatched to application handler callbacks without first verifying that the recipient channel ID exists as a confirmed entry in the encrypted session's channel table (enc.channels). This violates the SSH channel lifecycle defined in RFC 4254, which requires channel-scoped messages to operate on already-established channels. The affected CWEs are CWE-666 (Operation on Resource in Wrong Phase of Lifetime), CWE-696 (Incorrect Behavior Order), and CWE-863 (Incorrect Authorization). A secondary issue exists in server_handle_channel_open, where application-side channel references are inserted into self.channels even when the handler returns Ok(false) (denied), causing the two channel maps to diverge. A public PoC using Python's Paramiko library to send crafted SSH_MSG_CHANNEL_REQUEST packets is included in the advisory (Github Advisory, Patch Commit).

An authenticated attacker can bypass the server application's channel-open policy, causing handler callbacks such as exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close to execute for channel IDs that were never opened or were explicitly denied. The practical impact is highly dependent on the downstream application: for many SSH server use cases, these callbacks initiate commands, shells, SFTP-like subsystems, or other state-changing operations, meaning an attacker could trigger protected actions without a legitimate channel being established. The CVSS scoring reflects high integrity impact with no confidentiality or availability impact, though real-world consequences may vary significantly based on what the application's handler callbacks perform (Github Advisory).

1. Obtain valid credentials: Acquire a valid username and password (or key) for the target russh-based SSH server running a version ≤ 0.62.4.
2. Establish an authenticated SSH session: Use a standard SSH client or a library like Python's Paramiko to authenticate normally — transport.connect(username='alice', password='correct') — without opening a session channel.
3. Craft malicious channel request packets: Construct raw SSH_MSG_CHANNEL_REQUEST (message type 98) packets with arbitrary recipient channel IDs (e.g., 0–31), request type exec, and the desired command payload (e.g., protected), bypassing the SSH_MSG_CHANNEL_OPEN step entirely.
4. Send crafted packets: Transmit the crafted packets over the authenticated transport using transport._send_user_message(msg) in Paramiko, iterating over a range of channel IDs.
5. Trigger handler callbacks: The russh server dispatches exec_request (or other channel-scoped callbacks) for each crafted channel ID without validating channel existence, executing the protected action on the server side even though no channel was ever opened or confirmed (Github Advisory).

• Network: Authenticated SSH sessions that send SSH_MSG_CHANNEL_REQUEST (message type 98) packets without a preceding SSH_MSG_CHANNEL_OPEN (message type 90); rapid sequential channel request packets targeting a range of recipient channel IDs (e.g., 0–31) within a single session.
• Logs: SSH server logs showing exec_request or other channel callbacks being invoked for sessions where no channel open was recorded; application-level logs showing protected actions executed without a corresponding channel open event.
• Process/Application Behavior: Server-side handler callbacks (exec_request, shell_request, subsystem_request) firing for channel IDs not present in the established channel table; commands or subsystems being launched without a corresponding channel lifecycle entry (Github Advisory).

Upgrade russh to version 0.62.5, which introduces an is_established_channel() guard that checks enc.channels for a confirmed channel entry before dispatching any channel-scoped handler callback. The fix is implemented in commit 7c5659f and covers CHANNEL_REQUEST, CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, and CHANNEL_WINDOW_ADJUST. No configuration-based workaround is available; upgrading to 0.62.5 is the only remediation (russh Release, Patch Commit).