CVE-2026-56854

This is an incorrect-authorization flaw (CWE-863) in the SSH server implementation of Go's golang.org/x/crypto/ssh package: when a server sets the source-address (client IP) critical option in the Permissions returned by an authentication callback, the restriction was only actually enforced on the PublicKeyCallback and VerifiedPublicKeyCallback paths. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were never validated against the client's remote address, so any source-address restriction set there was silently ignored; this extends the incomplete fix for CVE-2026-46595, and the patch applies the check to Permissions returned by any authentication callback. An attacker who can reach the SSH server from any source address can authenticate and receive the permissions the operator intended to confine to specific IPs, bypassing IP-based access control and gaining access to confidential data (CVSS shows high confidentiality impact with no integrity or availability impact). Affected are any applications, gateways, and services that embed golang.org/x/crypto/ssh as an SSH server and rely on source-address Permissions set through the affected callbacks; servers that do not use such restrictions, or that set them only via the (Verified)PublicKeyCallback paths already covered, are not impacted. There is no known public proof-of-concept and no known exploitation: the issue is not in CISA KEV and EPSS is roughly 0.3% (25th percentile).

What to do: Upgrade golang.org/x/crypto to a release containing the fix that applies the source-address check to Permissions from all authentication callbacks (the fixed version is not given in the supplied data - check the Go vulnerability database entry for CVE-2026-56854). Until patched, do not rely on source-address restrictions set via PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin; enforce IP allowlisting with network-level controls (firewall/security-group rules) instead. If you never set source-address Permissions through those callbacks, no action beyond routine dependency updates is required.