CVE-2026-68930
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs th
CVSS
6.5
Medium
EPSS
0.4%
p32
KEV
—
Exploit Today
10
0-100
Published: Aug 3, 2026 · Last modified: Oct 23, 2026 · CWE-666 · CWE-696 · CWE-863
0.4%EPSS · 30 days0.4%
2026-10-082026-11-05
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. Version 0.62.5 fixes the issue.
- github.comhttps://github.com/Eugeny/russh/commit/7c5659f8cf6f6f2f9989d12dba0ebf49dc50a171
- github.comhttps://github.com/Eugeny/russh/releases/tag/v0.62.5
- github.comhttps://github.com/Eugeny/russh/security/advisories/GHSA-m65r-rprj-r5rg
- github.comhttps://github.com/Eugeny/russh/security/advisories/GHSA-m65r-rprj-r5rg
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1233343.8 LOW—
———In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project9hCVE-2026-1233333.8 LOW—
———In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints9hCVE-2026-1233286.4 MED—
———In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab9hCVE-2026-1233267.1 HIG—
———In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension9hCVE-2026-1233247.7 HIG—
———In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible9hCVE-2026-1232993.1 LOW—
———In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible9h