GO-2026-6303

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-6303
Import Source
https://vuln.go.dev/ID/GO-2026-6303.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-6303
Aliases
  • CVE-2026-56854
Related
Published
2026-08-28T14:47:45Z
Modified
2026-08-29T10:10:52.440319762Z
Summary
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Details

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Database specific 
{
    "url": "https://pkg.go.dev/vuln/GO-2026-6303",
    "review_status": "REVIEWED"
}
References
Credits
    • Longwei Wang (@gn00295120)

Affected packages

Go / golang.org/x/crypto

Package

Name
golang.org/x/crypto
View open source insights on deps.dev
Purl
pkg:golang/golang.org/x/crypto

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.55.0

Ecosystem specific 

{
    "imports": [
        {
            "path": "golang.org/x/crypto/ssh",
            "symbols": [
                "NewServerConn",
                "connection.serverAuthenticate"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-6303.json"