Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40884goshs: Empty-username SFTP password authentication bypass in goshs

Critical 9.8

In plain English

A critical-severity missing authentication in goshs from patrickhener. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/patrickhener/goshs	no fix listed	GO-2026-5303
Go	github.com/patrickhener/goshs	no fix listed	GHSA-c29w-qq4m-2gcv
Go	github.com/patrickhener/goshs/v2	2.0.0	GO-2026-5303
Go	github.com/patrickhener/goshs/v2	2.0.0	GHSA-c29w-qq4m-2gcv

Affected products (as reported)

Vendor	Product	Versions
patrickhener	goshs	< 2.0.0-beta.6

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv x_refsource_CONFIRM