CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

What is CVE-2026-39828?

CVE-2026-39828 is a medium-severity vulnerability in golang.org/x/crypto/ssh, published on 22 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Weakness: CWE-295, CWE-281

Which versions are affected by CVE-2026-39828?

3 open source packages ship an affected version, including golang.org/x/crypto. It affects 1 product.

Products include Golang Crypto.

How do I fix CVE-2026-39828?

Upgrade golang.org/x/crypto to 0.52.0 or later.

Is CVE-2026-39828 being exploited?

There is no known exploitation of CVE-2026-39828 in the wild and no public exploit code.

Other vulnerabilities in golang.org/x/crypto/ssh

• CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh Critical 10.0
• CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh Critical 9.1
• CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent Critical 9.1
• CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-87197, AZL-87239, AZL-87296, AZL-87429, AZL-87450, AZL-87759 and 1104 more.