GO-2026-5023

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

At a glance

Published: 2026-05-22 02:08 UTC
Updated: 2026-07-17 10:29 UTC
CVE: CVE-2026-46595
Aliases: GHSA-x527-x647-q7gg

Description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Affected packages

Package	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.52.0

References

https://go.dev/issue/79570 REPORT
https://groups.google.com/g/golang-announce/c/a082jnz-LvI WEB
https://go.dev/cl/781642 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database