Executive brief
An SSH authentication library in Go failed to properly validate source-address restrictions for most authentication methods. Attackers could bypass IP-based access controls set through password, keyboard-interactive, or other authentication callbacks, allowing unauthorized access from restricted IP ranges. This represents a partial failure of an intended security control, leaving organizations vulnerable even when they believed IP-based restrictions were in place.
Technical details
The vulnerability is a permission validation bypass in Go's SSH implementation where source-address restrictions were only enforced for PublicKeyCallback and VerifiedPublicKeyCallback authentication methods. PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks silently ignored source-address restrictions in their returned Permissions objects. An attacker with valid credentials could connect from IP addresses that should have been blocked by source-address restrictions, making the control ineffective for these authentication paths. The fix applies source-address validation uniformly across all authentication callback types.
Affected products
- Go golang.org/x/crypto/ssh prior to fix
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix available in Go CL/797040