russh: SSH agent fails to require confirmation for keys (CVE-2026-116794)

The SSH agent server in the russh library fails to invoke Agent::confirm when handling signing requests for keys added with the SSH_AGENT_CONSTRAIN_CONFIRM constraint (commonly applied via ssh-add -c). This logic error, introduced in version 0.50.0-beta.12 and persisting through version 0.64.1, replaces the required confirmation check with a hard-coded success result. Applications relying on this callback for security enforcement, such as Proton Pass desktop, do not prompt the user for authorization before performing cryptographic operations, effectively bypassing the protection provided by the confirm constraint.

Impact

Successful exploitation allows local processes or remote hosts (via SSH agent forwarding) to use protected SSH keys for authentication or data signing without user consent. The private key material itself is not exposed, but the ability to use the key is compromised for as long as an attacker maintains access to the agent socket.

Recommendation

• Update all software packages using russh to version 0.65 or later immediately.
• Review downstream applications that use russh to implement agent functionality and verify their Agent::confirm logic is invoked correctly.
• For applications that use confirm to perform security checks (e.g., "Pass is unlocked" checks), verify that the state logic is not bypassed by the regression.