Executive brief
A vulnerability in the Go SSH library could allow users to bypass security restrictions on their accounts. This library is commonly used by developers to build secure remote access tools and servers. If exploited, an attacker who has already provided one form of identification might be able to skip mandatory security rules, such as being restricted to a single specific command, potentially gaining broader access to the system than intended.
Technical details
A vulnerability exists in the golang.org/x/crypto/ssh package where the server-side authentication logic fails to preserve certificate permissions during multi-step authentication. Specifically, when an authentication callback returns a PartialSuccessError along with non-nil Permissions, the library silently discards those permissions. This can lead to the omission of critical certificate extensions, such as 'force-command', after a subsequent authentication factor (like a second factor) succeeds. An attacker with valid credentials for the first stage of authentication could exploit this to execute arbitrary commands or bypass intended environment restrictions. The issue is resolved in version 0.52.0 by treating the return of non-nil Permissions with a PartialSuccessError as a connection error.
Affected products
- Go golang.org/x/crypto/ssh < 0.52.0
Timeline
- 2026-05-21: disclosed: Issue opened on Go project tracker
- 2026-05-22: advisory: NVD and Go Vulnerability Database entries published
- 2026-06-25: advisory: GitHub Advisory published