CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/crypto/sshto a version that resolves this vulnerability.Fixed in 0.52.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46595?
CVE-2026-46595 has a risk score of 55, indicating a medium severity vulnerability.
How do I fix CVE-2026-46595?
To fix CVE-2026-46595, ensure that only the public key callback is used for verification to enforce proper permissions.
What software is affected by CVE-2026-46595?
CVE-2026-46595 affects the golang.org/x/crypto/ssh library.
What is the main problem addressed by CVE-2026-46595?
CVE-2026-46595 addresses an authorization bypass that occurs when a callback other than public key is utilized.
When was CVE-2026-46595 published?
CVE-2026-46595 was published on May 22, 2026.