CVE-2026-56854

HighCVSS 7.5/10Last modified Sep 3, 2026

Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
golang.org/x/crypto	golang.org/x/crypto/ssh	< 0.55.0

References

Timeline

Published: Aug 28, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-568557.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No CVE-2026-568579.8On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory CVE-2026-568586.1Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potenti CVE-2026-568597.5Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.CVE-2026-56868.8A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/CVE-2026-568605.9Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each st CVE-2026-568627.5Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not CVE-2026-568647.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor CVE-2026-568658.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an CVE-2026-568667.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without fra CVE-2026-56878.8A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStati CVE-2026-568768.1extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a