golang.org/x/crypto CVE-2026-39828

Upgrade golang.org/x/crypto to version 0.52.0 or later, which resolves the silent permission discard by returning a connection error when non-nil Permissions are passed with PartialSuccessError - see the upstream change at go.dev/cl/781621 and the Go vulnerability database entry at pkg.go.dev/vuln/GO-2026-5014. The fix is a breaking behavioral change: server implementations that previously returned non-nil Permissions alongside PartialSuccessError will now see connections fail, requiring code review of custom authentication callbacks. If immediate patching is not feasible, a compensating control is to audit all SSH server authentication callback implementations and ensure PartialSuccessError is returned with nil Permissions, deferring permission assignment to the final successful authentication stage - note this workaround requires code changes and careful testing to avoid introducing logic errors in permission assignment. Do not rely on network-layer filtering alone, as the vulnerability is exploitable by users who already hold valid first-factor credentials.