CVE-2026-39828 — Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate res…
Published: 2026-05-22 · CVSS: 6.3 · CVSS 3.1
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7