CVE-2026-102824

Executive Summary

CVE-2026-102824 is a cryptographic weakness in Russh, a Rust SSH client and server library, affecting all versions prior to 0.63.0. The hybrid ML-KEM-768/X25519 key exchange implementation accepts an all-zero 32-byte peer X25519 public key, collapsing the X25519 contribution of the combined shared secret to zero and leaving the negotiated secret dependent solely on ML-KEM. A malicious or machine-in-the-middle SSH peer can exploit this to strip the classical fallback component of the hybrid exchange, undermining the defense-in-depth guarantee that the hybrid design is intended to provide if ML-KEM is later weakened.

Technical Analysis

Russh implements a hybrid post-quantum key exchange combining ML-KEM-768 and X25519. In a properly implemented hybrid KEX, the combined shared secret is derived from both the ML-KEM shared secret and the X25519 shared secret such that both contribute. The defect described in NVD occurs in russh/src/kex/hybrid_mlkem.rs, where the implementation accepts an all-zero 32-byte peer X25519 public key in both the server_dh and compute_shared_secret code paths. Because the peer's X25519 public key is not validated against the all-zero value, the resulting X25519 contribution to the combined secret is forced to zero. The practical consequence is that the negotiated key depends only on ML-KEM-768, defeating the intended fallback protection of the hybrid construction.

The vulnerability class is CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), specifically an input-validation failure in a cryptographic primitive. The attack surface is the SSH transport-layer key exchange handshake: any remote peer — a malicious SSH server when Russh is used as a client, or a malicious SSH client when Russh is used as a server — that controls the peer X25519 public key can supply an all-zero value during KEX. The server_dh function and the compute_shared_secret routine are named in the NVD description as the locations where the all-zero key is accepted. Both the client and server roles are reported as affected in the description.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (base score 4.3) indicates a network-reachable issue with low attack complexity and low privileges required, no user interaction, and scope unchanged. The only impacted CIA component is confidentiality at Low severity, reflecting that the flaw does not by itself disclose key material but removes a cryptographic safety property. No integrity or availability impact is scored.

Michael et al. note: the description explicitly frames the impact as conditional — the hybrid exchange's intended fallback protection is defeated "if ML-KEM is later weakened." There is no claim in the provided data that ML-KEM is currently broken; the issue is the loss of the classical hedge rather than an immediate key-recovery primitive. No EPSS score is available (not yet scored by FIRST.org). No CISA KEV listing applies. No public PoC, exploit code, or Nuclei template is known.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the mechanism described in NVD.

1. Reconnaissance/target identification: An adversary identifies a target service or client that negotiates the hybrid ML-KEM-768/X25519 key exchange using an affected Russh build (version prior to 0.63.0). This can be an SSH server built on Russh that a victim client connects to, or an SSH client built on Russh connecting to an attacker-controlled or compromised server. Because the manipulation happens inside the KEX negotiation, a machine-in-the-middle positioned on the network path can also act as the malicious peer.

2. Triggering the flaw class: During the SSH transport-layer key exchange, the malicious peer supplies an all-zero 32-byte X25519 public key. The affected hybrid_mlkem.rs code path (server_dh and compute_shared_secret) accepts this value without rejecting it. The X25519 shared-secret contribution is therefore forced to zero, and the combined secret becomes a function of ML-KEM-768 material only.

3. Payload/execution at the vulnerability-class level: No crafted payload beyond the malformed KEX public key value is required. The attacker's objective at this stage is protocol-level: force the peer to complete a hybrid handshake whose classical component contributes nothing, rather than abort the connection or flag the degenerate key. This is an input-validation bypass in a cryptographic negotiation, not memory corruption and not remote code execution. Any downstream weakness or future cryptanalytic advance against ML-KEM-768 would then apply to a session that the victim believes retains classical X25519 protection.

4. Post-exploitation impact: The immediate observable outcome is a successfully completed SSH session in which the hybrid fallback property has been silently removed. Confidentiality is scored Low because the flaw removes a hedging property rather than directly exposing plaintext; the practical risk materializes if ML-KEM-768 is subsequently weakened, at which point sessions established under this condition would be exposed to retrospective decryption by an adversary who recorded the handshake. No integrity or availability effects are scored.

Detection depends on identifying anomalous KEX behavior — specifically, hybrid key exchange negotiations where a peer presents an all-zero X25519 public key — rather than on signature-based matching of a payload.

Impact Assessment

Business impact centers on loss of cryptographic assurance rather than immediate data compromise. Organizations relying on Russh for SSH transport that have explicitly adopted the hybrid ML-KEM/X25519 exchange for post-quantum migration face a silent downgrade of that hedge: the classical X25519 component can be nullified by a hostile peer, leaving the session dependent on ML-KEM-768 alone. This is materially relevant to "harvest now, decrypt later" threat models, where adversaries record encrypted sessions for future decryption. The CVSS subscores — AV:N (network reachable), AC:L (no special conditions), PR:L (low privileges), UI:N (no user interaction), S:U (unchanged scope), C:L (low confidentiality), I:N, A:N — indicate a moderate-severity issue that is easy to reach but whose realized impact is deferred and conditional.

Blast radius includes any deployment where Russh versions prior to 0.63.0 are compiled in as either the SSH client or server component, including embedded agents, CI/CD nodes, container images, and network appliances that embed the library. The scope is unchanged because exploitation does not pivot beyond the affected SSH endpoint. No exploit-in-the-wild activity, threat actor campaign, or KEV listing is associated with this CVE in the provided data. There is no evidence of active exploitation.

Detection Guidance

Note on detection realism: because the attack is a protocol-level KEX input-validation bypass and no public exploit artifacts exist, the following rules focus on anomalous SSH hybrid key exchange behavior, all-zero X25519 public key material, and Russh library version/telemetry rather than a known payload signature.

Sigma Rule

title: SSH Hybrid ML-KEM X25519 Key Exchange With All-Zero Peer X25519 Public Key
id: 8f3c1a2e-5b7d-4c9e-a1f0-3d6e9b2c7a41
status: experimental
description: Detects SSH key exchange negotiation involving hybrid ML-KEM-768/X25519 where an all-zero 32-byte X25519 public key is presented, consistent with CVE-2026-102824 against Russh < 0.63.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102824
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: ssh
detection:
  selection_kex:
    ssh.kex_algorithm|contains:
      - 'mlkem768x25519'
      - 'mlkem768-x25519'
      - 'hybrid'
  selection_zerokey:
    ssh.peer_x25519_public_key|contains: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
  condition: selection_kex and selection_zerokey
fields:
  - src_ip
  - dst_ip
  - ssh.client
  - ssh.server
level: medium
tags:
  - attack.t1190
  - cwe.327

YARA Rule

rule CVE_2026_102824_Russh_Hybrid_MLKEM_Zero_X25519
{
    meta:
        description = "Detects Russh hybrid ML-KEM/X25519 KEX source artifacts referenced by CVE-2026-102824 (pre-0.63.0 code, unvalidated peer X25519 key)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102824"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $path1 = "russh/src/kex/hybrid_mlkem.rs" ascii
        $fn1   = "server_dh" ascii
        $fn2   = "compute_shared_secret" ascii
        $alg1  = "mlkem768x25519" ascii nocase
        $alg2  = "mlkem768-x25519" ascii nocase

    condition:
        ($path1 or ($fn1 and $fn2)) and ($alg1 or $alg2)
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-102824 Possible Russh Hybrid ML-KEM X25519 KEX Manipulation (all-zero X25519 peer key in SSH KEXINIT/key exchange)"; flow:established,to_server; content:"|14|"; depth:1; content:"mlkem768x25519"; nocase; sid:2026102824; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-102824, affected_product Russh, attack_target Server, deployment Perimeter, signature_severity Minor; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102824; classtype:protocol-command-decode;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and process.name == "sshd"]
  [network where network.transport == "tcp" and
     process.name in ("sshd", "russh") and
     network.direction == "inbound" and
     process.command_line : "*mlkem*"]

Splunk SPL Query

index=network OR index=ssh
| search (ssh_kex_algorithm="*mlkem*x25519*" OR ssh_kex_algorithm="*hybrid*")
| where match(peer_x25519_public_key, "^A+$") OR len(peer_x25519_public_key)=44 AND peer_x25519_public_key="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
| stats count values(src_ip) as source_ips values(dest_ip) as dest_ips by ssh_kex_algorithm host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="ssh,cve-2026-102824,russh,">
  <rule id="2026102824" level="8">
    <decoded_as>sshd</decoded_as>
    <match>mlkem768x25519|mlkem768-x25519|hybrid kex</match>
    <description>CVE-2026-102824: SSH hybrid ML-KEM/X25519 key exchange observed - possible RossH hybrid KEX manipulation (all-zero peer X25519 key)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cryptographic,t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: the NVD description states the issue is fixed in version 0.63.0, but no patch evidence is currently corroborated by any tracked source, no vendor advisory is listed, no workarounds are documented, and no affected-version package metadata is available. Treat this as effectively unpatched pending independent verification against the upstream repository.

1. Immediate mitigations

• Disable or deprioritize the hybrid ML-KEM-768/X25519 key exchange algorithm on affected Russh-based SSH clients and servers until the fix is verified, relying on a well-vetted classical suite (e.g., curve25519-sha256) rather than a hybrid whose classical component can be nullified.
• Where algorithm selection is not controllable, restrict network reachability of affected SSH endpoints to trusted peers, and treat any machine-in-the-middle-capable position as a threat to hybrid KEX integrity.
• Monitor KEX negotiation logs for hybrid algorithms and for degenerate public key material, using the detection rules above as a compensating control.

2. Patch/upgrade steps

• Upgrade Russh to 0.63.0 or later, per the NVD description, after verifying the release is available from the upstream project and reviewing its changelog for the russh/src/kex/hybrid_mlkem.rs fix. Given patch confidence 0/4, independently confirm the change rejects all-zero peer X25519 public keys in server_dh and compute_shared_secret before closing risk.
• Rebuild and redeploy any container images, static binaries, or vendored copies that embed the affected library; ensure dependency manifests pin the corrected version.

3. Long-term hardening

• Add input validation for all public key and shared-secret inputs to cryptographic routines, explicitly rejecting degenerate/identity values.
• Adopt cryptographic agility practices: prefer cipher suites under active maintenance, track library advisories for post-quantum hybrid implementations, and include hybrid KEX integrity checks in periodic cryptographic reviews.
• Maintain an inventory of embedded SSH libraries so that affected versions can be located quickly, and monitor NVD, OSV, and upstream Russh channels for an authoritative advisory to replace the current 0/4 patch-confidence assessment.

References

• NVD — CVE-2026-102824: https://nvd.nist.gov/vuln/detail/CVE-2026-102824
• Russh upstream project (Rust SSH client and server library) — release 0.63.0 and repository: https://github.com/Eugeny/russh
• CWE-327 — Use of a Broken or Risky Cryptographic Algorithm: https://cwe.mitre.org/data/definitions/327.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV listing are associated with CVE-2026-102824 in the provided intelligence.