CVE-2026-56854: SSH Authentication Bypass Vulnerability

CVE-2026-56854 Overview

CVE-2026-56854 is an authorization flaw in the Go golang.org/x/crypto/ssh package. The source-address critical option returned by authentication callbacks was enforced only for PublicKeyCallback and VerifiedPublicKeyCallback paths. Permissions returned by PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin bypassed the check, so any source-address restriction those callbacks configured was silently ignored. The issue extends the earlier fix for CVE-2026-46595 and is tracked as GO-2026-6303. The weakness is classified under [CWE-863] (Incorrect Authorization).

Critical Impact
Attackers can authenticate to SSH servers from network locations that server operators intended to block, defeating IP-based access controls set through non-public-key authentication callbacks.

Affected Products

golang.org/x/crypto/ssh package (Go SSH library)
Go applications relying on PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin for authentication
SSH server implementations built on the Go x/crypto module that enforce source-address restrictions through these callbacks

Discovery Timeline

2026-08-28 - CVE-2026-56854 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-56854

Vulnerability Analysis

The Go SSH server library supports per-user access controls through ssh.Permissions structures returned by authentication callbacks. One of these controls is the source-address critical option, which restricts a session to specific client IP ranges. The library enforced this restriction only after successful public-key authentication.

When operators configured a PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPI login callback and returned a Permissions object containing source-address, the server accepted the login regardless of the client's remote address. The restriction was treated as advisory metadata rather than an enforceable policy, producing a silent authorization gap.

The fix applies the source-address check to Permissions returned by any authentication callback, aligning behavior across all authentication paths.

Root Cause

The root cause is inconsistent enforcement of authorization metadata across authentication flows. The public-key code path evaluated the source-address critical option against the client's remote address, but parallel code paths for password, keyboard-interactive, GSSAPI, and no-auth flows omitted this check. This is a classic [CWE-863] Incorrect Authorization defect where the check exists but is not invoked in every applicable code path.

Attack Vector

An attacker connects to a vulnerable SSH server from an IP address that the operator intended to block through a source-address restriction. If the server authenticates the user through any callback other than the two public-key callbacks, the restriction is not applied and the session proceeds. The attack requires valid credentials or an authentication method the server accepts, and it is exploitable over the network without user interaction. Successful exploitation grants access from unauthorized network locations, undermining defense-in-depth controls that assume source-address enforcement.

See the Go.dev Code Review and Go.dev Issue Tracker for the patch details.

Detection Methods for CVE-2026-56854

Indicators of Compromise

Successful SSH logins recorded from client IP ranges that fall outside documented source-address allowlists
Authentication events for accounts protected by password, keyboard-interactive, or GSSAPI flows originating from unexpected geographies or ASNs
Session activity that contradicts the intended per-user network access policy

Detection Strategies

Inventory Go binaries and services that import golang.org/x/crypto/ssh and identify those using non-public-key authentication callbacks
Correlate SSH accept logs with the documented source-address policy per account to find allowed logins that should have been rejected
Compare authentication path metadata (password vs. public-key) with permission enforcement outcomes to surface silent bypasses

Monitoring Recommendations

Ship SSH server logs to a centralized analytics pipeline and alert on logins from IPs outside per-account allowlists
Track dependency versions of golang.org/x/crypto across the software inventory and flag builds pinned to vulnerable versions
Baseline expected client subnets per service account and alert on deviations, independent of what the SSH library reports

How to Mitigate CVE-2026-56854

Immediate Actions Required

Upgrade golang.org/x/crypto to the fixed version referenced in GO-2026-6303 and rebuild all affected Go binaries
Audit every use of PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin for reliance on source-address restrictions
Redeploy patched binaries to production hosts and confirm dependency resolution with go list -m all

Patch Information

The upstream fix applies the source-address check to Permissions returned by any authentication callback. Review the change at the Go.dev Code Review and the tracking record at the Go.dev Issue Tracker. Consult the Go.dev Vulnerability Report for the exact fixed module version and use govulncheck to verify remediation.

Workarounds

Enforce source-address restrictions outside the SSH library, for example through host firewall rules, cloud security groups, or a bastion with strict ACLs
Restrict SSH listeners to management networks until patched binaries are deployed
Temporarily disable password, keyboard-interactive, GSSAPI, and no-auth callbacks that depend on source-address and require public-key authentication instead

bash

# Verify and update the vulnerable dependency
go list -m golang.org/x/crypto
go get golang.org/x/crypto@latest
go mod tidy
govulncheck ./...