CVE-2026-46595 — Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-ad…
Published: 2026-05-22 · CVSS: 10.0 · CVSS 3.1
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7