CVE-2026-42189 Overview
CVE-2026-42189 is a pre-authentication denial-of-service vulnerability in Russh, a Rust SSH client and server library. The flaw resides in the server's keyboard-interactive authentication handler. A malicious client can crash any Russh-based server that implements keyboard-interactive authentication, such as for two-factor authentication (2FA) or time-based one-time password (TOTP) flows. Exploitation requires only a single malformed packet and no valid credentials. The issue affects Russh versions prior to 0.60.1 and downstream consumers including Warpgate. Maintainers patched the flaw in Russh version 0.60.1.
Critical Impact
Unauthenticated attackers can crash any Russh-based SSH server with keyboard-interactive authentication enabled by sending a single malformed packet, causing a complete service outage.
Affected Products
- Russh versions prior to 0.60.1
- Warpgate (downstream consumer of Russh)
- Any Rust application embedding Russh server with keyboard-interactive auth enabled
Discovery Timeline
- 2026-05-08 - CVE-2026-42189 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-42189
Vulnerability Analysis
The vulnerability is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling) and manifests as a denial-of-service condition during the SSH authentication phase. Russh implements the SSH keyboard-interactive authentication method described in RFC 4256, commonly used to layer 2FA or TOTP prompts on top of password authentication.
The server's handler for keyboard-interactive packets fails to validate input fields before processing them. A client can dispatch a malformed SSH_MSG_USERAUTH_INFO_RESPONSE packet during the pre-authentication exchange, which triggers a panic or unhandled error in the Rust runtime. The thread or process serving SSH terminates, denying service to all subsequent connections.
Because the bug fires before credential verification, no account, key, or session state is required. Any network attacker able to reach the SSH port can repeatedly exploit the flaw to keep the service offline.
Root Cause
The handler accepts client-supplied data from the keyboard-interactive flow without validating structure or bounds. The unvalidated input drives logic that panics on unexpected values, propagating the failure to the server task. The patch in commit 6c3c80a9b6d60763d6227d60fa8310e57172a4d1 adds defensive parsing so malformed packets are rejected instead of crashing the handler.
Attack Vector
Exploitation occurs over the network against any exposed Russh server with keyboard-interactive authentication enabled. The attacker opens a TCP connection to the SSH port, completes the SSH transport handshake, requests keyboard-interactive authentication, and submits a crafted response packet. The server process crashes, terminating all in-flight SSH sessions. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-f5v4-2wr6-hqmg.
Detection Methods for CVE-2026-42189
Indicators of Compromise
- Unexpected termination or panic messages from Russh-based server processes immediately after inbound SSH connections.
- Repeated short-lived SSH connections from a single source IP followed by service restarts.
- SSH service unavailability correlating with keyboard-interactive authentication attempts in logs.
Detection Strategies
- Monitor process supervisor logs (systemd, Kubernetes restarts, container exit codes) for crash loops in Russh or Warpgate workloads.
- Inspect application logs for Rust panic stack traces originating in the keyboard-interactive authentication module.
- Correlate SSH connection attempts from untrusted sources with subsequent service restart events using SIEM correlation rules.
Monitoring Recommendations
- Alert on abnormal restart rates for SSH bastion services such as Warpgate.
- Track SSH authentication failure and disconnect metrics for sudden spikes from a single source.
- Enable network telemetry on the SSH listening port to identify probing patterns targeting authentication methods.
How to Mitigate CVE-2026-42189
Immediate Actions Required
- Upgrade Russh to version 0.60.1 or later in all dependent Rust applications and rebuild affected binaries.
- Update Warpgate deployments to a release that bundles the patched Russh dependency.
- Inventory internal services that embed Russh and prioritize internet-facing or bastion deployments first.
Patch Information
The maintainers fixed the vulnerability in Russh 0.60.1. The remediation is published in the GitHub Release v0.60.1 and the corresponding GitHub Commit Update. Consumers should update their Cargo.toml dependency constraint and run cargo update -p russh followed by a full rebuild.
Workarounds
- Disable the keyboard-interactive authentication method on Russh servers until patching is complete, falling back to public key authentication.
- Restrict network access to SSH listeners using firewall rules, allow-lists, or VPN-only exposure.
- Place SSH services behind rate-limiting or connection-throttling proxies to slow repeated exploitation attempts.
# Configuration example: update Russh dependency to patched version
# In Cargo.toml
# [dependencies]
# russh = "0.60.1"
cargo update -p russh
cargo build --release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
