Log in Start free

Vulnerability · Published May 22, 2026 · Assigned by Go

CVE-2026-46595Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Critical 10.0

In plain English

A critical-severity incorrect authorization in golang.org/x/crypto/ssh from golang.org/x/crypto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.6%top 53.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-go.cryptono fix listedDEBIAN-CVE-2026-46595
Debian:13golang-go.cryptono fix listedDEBIAN-CVE-2026-46595
Debian:14golang-go.crypto1:0.52.0-1DEBIAN-CVE-2026-46595
Gogolang.org/x/crypto0.52.0GHSA-x527-x647-q7gg
Gogolang.org/x/crypto0.52.0GO-2026-5023
Ubuntu:25.10golang-go.cryptono fix listedUBUNTU-CVE-2026-46595
Ubuntu:24.04:LTSgoogle-guest-agent20250116.00-0ubuntu1~24.04.4UBUNTU-CVE-2026-46595
Ubuntu:25.10google-guest-agent20250506.01-0ubuntu1.2UBUNTU-CVE-2026-46595
Ubuntu:26.04:LTSgoogle-guest-agent20250506.01-0ubuntu2.1UBUNTU-CVE-2026-46595
Ubuntu:22.04:LTSsnapdno fix listedUBUNTU-CVE-2026-46595
Ubuntu:24.04:LTSsnapdno fix listedUBUNTU-CVE-2026-46595
Ubuntu:25.10snapdno fix listedUBUNTU-CVE-2026-46595
Ubuntu:26.04:LTSsnapdno fix listedUBUNTU-CVE-2026-46595
Ubuntu:26.10snapdno fix listedUBUNTU-CVE-2026-46595

Affected products (as reported)

VendorProductVersions
golang.org/x/crypto golang.org/x/crypto/ssh 0 – before 0.52.0

Weakness: CWE-863, CWE-303 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References