Log in Start free

Vulnerability · Published May 22, 2026 · Assigned by Go

CVE-2026-39828Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Medium 6.3

In plain English

A medium-severity security flaw in golang.org/x/crypto/ssh from golang.org/x/crypto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-go.cryptono fix listedDEBIAN-CVE-2026-39828
Debian:13golang-go.cryptono fix listedDEBIAN-CVE-2026-39828
Debian:14golang-go.crypto1:0.52.0-1DEBIAN-CVE-2026-39828
Gogolang.org/x/crypto0.52.0GO-2026-5014
Gogolang.org/x/crypto0.52.0GHSA-45gg-vh54-h5m9
Ubuntu:25.10golang-go.cryptono fix listedUBUNTU-CVE-2026-39828
Ubuntu:26.10golang-go.cryptono fix listedUBUNTU-CVE-2026-39828
Ubuntu:22.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-39828
Ubuntu:24.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-39828
Ubuntu:25.10google-guest-agentno fix listedUBUNTU-CVE-2026-39828
Ubuntu:26.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-39828
Ubuntu:26.10google-guest-agentno fix listedUBUNTU-CVE-2026-39828
Ubuntu:22.04:LTSsnapdno fix listedUBUNTU-CVE-2026-39828
Ubuntu:24.04:LTSsnapdno fix listedUBUNTU-CVE-2026-39828
Ubuntu:25.10snapdno fix listedUBUNTU-CVE-2026-39828
Ubuntu:26.04:LTSsnapdno fix listedUBUNTU-CVE-2026-39828
Ubuntu:26.10snapdno fix listedUBUNTU-CVE-2026-39828

Affected products (as reported)

VendorProductVersions
golang.org/x/crypto golang.org/x/crypto/ssh 0 – before 0.52.0

Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References