Skip to main content

golang.org/x/crypto SSH EUVDEUVD-2026-67741

| CVE-2026-56854 HIGH
Incorrect Authorization (CWE-863)
2026-08-28 Go GHSA-gjhq-gjfw-99mq
Authentication Bypass Suse Golang Org X Crypto Ssh Golang Org X Crypto
7.5
CVSS 3.1 · Vendor: Go
Share

Severity by source

Vendor (Go) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

AC:H because exploitation requires server-side source-address restrictions configured via affected callbacks, a condition beyond attacker control; I:L added for SSH session file-transfer capability.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Red Hat
9.1 CRITICAL
qualitative

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 28, 2026 - 22:37 vuln.today
CVSS changed
Aug 28, 2026 - 22:22 NVD
7.5 (HIGH)
Patch available
Aug 28, 2026 - 17:02 EUVD
CVE Published
Aug 28, 2026 - 15:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 28, 2026 - 15:14 cve.org
HIGH 7.5

DescriptionCVE.org

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

AnalysisAI

Source-address critical option enforcement in golang.org/x/crypto/ssh is incomplete, allowing remote attackers to bypass IP-based access controls on Go-based SSH servers using PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin authentication paths. Versions prior to 0.55.0 silently ignore source-address restrictions returned by these callbacks, defeating an explicit authorization control set by the server application. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three co-occurring conditions: (1) the target application implements an SSH server using golang.org/x/crypto/ssh at a version prior to 0.55.0; (2) the application uses at least one of PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin as its authentication mechanism; and (3) the Permissions object returned by that callback includes a source-address critical option restricting client IP addresses. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High) reflects network-reachable, unauthenticated exploitation with high confidentiality impact and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade golang.org/x/crypto to version 0.55.0 or later, which unifies source-address critical option enforcement across all authentication callback paths. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Go applications using golang.org/x/crypto/ssh and determine which ones enforce IP-based source-address restrictions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Golang Org X Crypto Ssh

View all
CVE-2026-39830 CRITICAL POC
9.1 May 22

Resource exhaustion in the Go golang.org/x/crypto/ssh package allows a malicious SSH peer to leak goroutines and memory

CVE-2026-39829 HIGH POC
7.5 May 22

Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remote attacker
CVE-2026-46597 HIGH POC
7.5 May 22

Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) allows remote unauthenticated att
CVE-2026-39827 MEDIUM POC
6.5 May 22

Unbounded memory growth in the golang.org/x/crypto/ssh package allows an authenticated remote attacker to crash the SSH

CVE-2026-39828 MEDIUM POC
6.3 May 22

SSH certificate permission enforcement in golang.org/x/crypto/ssh fails silently during multi-factor authentication flow
CVE-2026-46595 CRITICAL
10.0 May 22

Authorization bypass in the Go golang.org/x/crypto/ssh package before version 0.52.0 allows remote attackers to circumve
CVE-2026-39835 MEDIUM POC
5.3 May 22

Unauthenticated remote clients can crash SSH servers built with golang.org/x/crypto/ssh by presenting a certificate duri
CVE-2026-39834 CRITICAL
9.1 May 22

Denial of service in the Go golang.org/x/crypto/ssh package (versions prior to 0.52.0) occurs when an application writes
CVE-2026-39831 CRITICAL
9.1 May 22

Authentication bypass in the Go x/crypto/ssh library (versions before 0.52.0) allows SSH servers to accept FIDO/U2F secu

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP6-CHOST-BYOS-GCE Affected
SLES15-SP6-CHOST-BYOS-GCE Affected
SLES15-SP7-CHOST-BYOS-GCE Affected

Share

EUVD-2026-67741 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy