CVE-2026-56854: Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Affected Software
Event History
Frequently Asked Questions
Which authentication configurations are affected?
Deployments are affected when PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin returns Permissions containing a source-address critical option. PublicKeyCallback and VerifiedPublicKeyCallback already enforced this restriction.
What does an attacker need to exploit this issue?
An attacker must be able to authenticate through one of the affected callback paths while connecting from an address that should be disallowed by the source-address restriction. The vulnerable behavior silently ignores that restriction for those callbacks.
Are deployments using public-key authentication callbacks affected?
The described missing validation does not apply to Permissions returned by PublicKeyCallback or VerifiedPublicKeyCallback, because those paths already enforced the client's remote address against the source-address option.
How can I determine whether my application is exposed?
Review SSH server authentication callbacks and identify whether any affected callback returns Permissions with a source-address critical option. If so, verify whether the application is using a version in which source-address validation is applied to Permissions from every authentication callback.