Is CVE-2026-46595 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46595 being exploited in the wild.

How severe is CVE-2026-46595?

Critical severity, with a CVSS score of 10, published 22 May 2026.

Which products and versions are affected?

golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.52.0; golang.org/x/crypto/ssh (Go) < 0.52.0.

Is there a fix for CVE-2026-46595?

Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46595 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46595?

Check whether you run golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46595: Go x/crypto authorization bypass in SSH server source-address validation

Q: Is there a fix for CVE-2026-46595?

Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46595 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46595?

Check whether you run golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46595 · Severity: critical · CVSS 10 · Published 2026-05-22

A vulnerability in the Go SSH library could allow unauthorized users to bypass security restrictions when connecting to a server. This library is commonly used by developers to build secure communication tools and remote access services. An exploit could allow an attacker to bypass source-address validation or other permission checks, potentially leading to unauthorized access to sensitive systems or data.

Technologies: golang.org/x/crypto (Go), golang.org/x/crypto/ssh (Go). Vendors: Go.

Quick answers

Is CVE-2026-46595 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46595 being exploited in the wild.
How severe is CVE-2026-46595?: Critical severity, with a CVSS score of 10, published 22 May 2026.
Which products and versions are affected?: golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.52.0; golang.org/x/crypto/ssh (Go) < 0.52.0.
Is there a fix for CVE-2026-46595?: Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46595 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46595?: Check whether you run golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/crypto (Go): upgrade to 0.52.0 or later
```
go get golang.org/x/crypto@v0.52.0
```

Technical details

An authorization bypass exists in golang.org/x/crypto/ssh due to incorrect enforcement in the VerifiedPublicKeyCallback mechanism. When a server configuration uses callbacks other than the standard public key callback, the library may skip critical permission enforcements, including source-address validation. This is a regression or related failure following the fix for CVE-2024-45337. An unauthenticated remote attacker can exploit this to bypass intended access controls. The issue is rooted in how the serverAuthenticate and NewServerConn functions handle permissions during the handshake. The vulnerability is addressed in version 0.52.0.

Affected products

Go golang.org/x/crypto/ssh < 0.52.0

Identifiers

CVE-2026-46595
GHSA-x527-x647-q7gg
GO-2026-5023

Timeline

2026-05-22: disclosed: NVD publication date
2026-06-25: advisory: GitHub Advisory published
2026-06-25: patched: Version 0.52.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.