GO-2026-6303

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

At a glance

Published: 2026-08-28 14:47 UTC
Updated: 2026-08-29 10:10 UTC
CVE: CVE-2026-56854

Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Affected packages

Package	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.55.0

References

https://go.dev/issue/80213 REPORT
https://go.dev/cl/797040 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database