CVE-2026-46595

CRITICAL10.0EPSS 0.05%

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Published: 5/22/2026Modified: 5/27/2026

Also known as:CGA-33qc-7m28-fvwrGO-2026-5023

Description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Affected packages (2)

Debian/golang-go.cryptofrom 0
Go/golang.org/x/cryptofrom 0, < 0.52.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References (4)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-46595
PATCHhttps://go.dev/cl/781642
REPORThttps://go.dev/issue/79570
WEBhttps://groups.google.com/g/golang-announce/c/a082jnz-LvI