CVE-2026-56854
Received Received - Intake

Source Address Validation Bypass in Go SSH Authentication

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Go Project

Description
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-56854
EUVD
EUVD-2026-67741

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
golang golang.org to 0.55.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper enforcement of source-address restrictions in authentication callbacks. The system only checked source addresses for certain callback paths, allowing others to bypass these restrictions silently. This means attackers could bypass intended network-based access controls if they exploited callbacks that were not properly validated.

Detection Guidance

This vulnerability affects the golang.org/x/crypto/ssh package before version v0.55.0. To detect it, check the version of the package in your Go environment using the command: go list -m golang.org/x/crypto@ssh. If the version is below v0.55.0, the system is vulnerable.

Impact Analysis

If you rely on source-address restrictions for authentication callbacks, this vulnerability could allow unauthorized access. Attackers might bypass security controls by exploiting callbacks that do not validate client remote addresses, potentially gaining access to systems or data they should not be able to reach.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a source-address validation flaw in the golang.org/x/crypto/ssh package. However, if source-address restrictions are used for access control in systems handling sensitive data, bypassing these restrictions could potentially lead to unauthorized access, which may impact compliance with data protection standards.

Mitigation Strategies

Update to the latest version of Go where this fix is applied. Review authentication callback configurations to ensure source-address restrictions are properly enforced across all callback types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart