CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Attackers can bypass source-address restrictions in Go SSH server authentication callbacks that do not use public key methods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56854?
CVE-2026-56854 is a high-severity authentication bypass vulnerability in golang.org/x/crypto/ssh, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Weakness: CWE-863
Which versions are affected by CVE-2026-56854?
1 open source package ship an affected version, including golang.org/x/crypto.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/crypto Go | All versions | 0.55.0 |
Linux distribution packages (2)
amazon-ssm-agent openSUSE:Tumbleweed | All versions | 3.3.5390.0-1.1 |
google-osconfig-agent openSUSE:Tumbleweed | All versions | 20260908.00-2.1 |
How do I fix CVE-2026-56854?
Upgrade golang.org/x/crypto to 0.55.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-56854 being exploited?
There is no known exploitation of CVE-2026-56854 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-56854, CLEANSTART-2026-CF02971, CLEANSTART-2026-EX19348, CLEANSTART-2026-FP42808, CLEANSTART-2026-GH89937, CLEANSTART-2026-IG26427 and 1365 more.