# CVE-2026-46595: Go x/crypto authorization bypass in SSH server source-address validation

Source: https://junglewise.ai/threats/cve-2026-46595-go-x-crypto-authorization-bypass-in-ssh-server-source-address  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-46595 · Severity: critical · CVSS 10 · Published 2026-05-22

A vulnerability in the Go SSH library could allow unauthorized users to bypass security restrictions when connecting to a server. This library is commonly used by developers to build secure communication tools and remote access services. An exploit could allow an attacker to bypass source-address validation or other permission checks, potentially leading to unauthorized access to sensitive systems or data.

Technologies: [golang.org/x/crypto (Go)](https://junglewise.ai/threats/technologies/golang-org-x-crypto), [golang.org/x/crypto/ssh (Go)](https://junglewise.ai/threats/technologies/golang-org-x-crypto-ssh). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-46595 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46595 being exploited in the wild.

**How severe is CVE-2026-46595?** Critical severity, with a CVSS score of 10, published 22 May 2026.

**Which products and versions are affected?** golang.org/x/crypto (Go) SEMVER:introduced=0,fixed=0.52.0; golang.org/x/crypto/ssh (Go) < 0.52.0.

**Is there a fix for CVE-2026-46595?** Yes. golang.org/x/crypto (Go): upgrade to 0.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46595 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46595?** Check whether you run golang.org/x/crypto (Go) or golang.org/x/crypto/ssh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/crypto (Go): upgrade to 0.52.0 or later

  ```sh
  go get golang.org/x/crypto@v0.52.0
  ```


## Technical details

An authorization bypass exists in golang.org/x/crypto/ssh due to incorrect enforcement in the VerifiedPublicKeyCallback mechanism. When a server configuration uses callbacks other than the standard public key callback, the library may skip critical permission enforcements, including source-address validation. This is a regression or related failure following the fix for CVE-2024-45337. An unauthenticated remote attacker can exploit this to bypass intended access controls. The issue is rooted in how the serverAuthenticate and NewServerConn functions handle permissions during the handshake. The vulnerability is addressed in version 0.52.0.

## Affected products

- Go golang.org/x/crypto/ssh < 0.52.0

## Identifiers

- CVE-2026-46595
- GHSA-x527-x647-q7gg
- GO-2026-5023

## Timeline

- 2026-05-22: disclosed: NVD publication date
- 2026-06-25: advisory: GitHub Advisory published
- 2026-06-25: patched: Version 0.52.0 released

## References

- [https://go.dev/cl/781642](https://go.dev/cl/781642)
- [https://go.dev/issue/79570](https://go.dev/issue/79570)
- [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://pkg.go.dev/vuln/GO-2026-5023](https://pkg.go.dev/vuln/GO-2026-5023)

## Related threats

- [Go SSH deadlock vulnerability in channel handling](https://junglewise.ai/threats/cve-2026-56855-go-ssh-deadlock-vulnerability-in-channel-handling)
- [Go x/crypto/ssh deadlock denial of service on undecided channel](https://junglewise.ai/threats/cve-2026-78662-go-2026-6354-prevent-dos-on-deadlocked-undecided-channel-in)
- [Go SSH source-address permission validation bypass in authentication callbacks](https://junglewise.ai/threats/cve-2026-56854-go-ssh-source-address-permission-validation-bypass-in)
- [GO-2026-5932 - The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues](https://junglewise.ai/threats/go-2026-5932-the-golang-org-x-crypto-openpgp-package-is-unmaintained-7e8ca4de)
- [Go x/crypto denial of service in SSH agent Ed25519 parsing](https://junglewise.ai/threats/cve-2026-46598-go-x-crypto-denial-of-service-in-ssh-agent-ed25519-parsing)