Executive brief
A vulnerability in the Go SSH library could allow unauthorized users to bypass security restrictions when connecting to a server. This library is commonly used by developers to build secure communication tools and remote access services. An exploit could allow an attacker to bypass source-address validation or other permission checks, potentially leading to unauthorized access to sensitive systems or data.
Technical details
An authorization bypass exists in golang.org/x/crypto/ssh due to incorrect enforcement in the VerifiedPublicKeyCallback mechanism. When a server configuration uses callbacks other than the standard public key callback, the library may skip critical permission enforcements, including source-address validation. This is a regression or related failure following the fix for CVE-2024-45337. An unauthenticated remote attacker can exploit this to bypass intended access controls. The issue is rooted in how the serverAuthenticate and NewServerConn functions handle permissions during the handshake. The vulnerability is addressed in version 0.52.0.
Affected products
- Go golang.org/x/crypto/ssh < 0.52.0
Timeline
- 2026-05-22: disclosed: NVD publication date
- 2026-06-25: advisory: GitHub Advisory published
- 2026-06-25: patched: Version 0.52.0 released