Riskcovery

CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

State
Published
Severity
6.3 Medium
Published
May 22, 2026
Updated
Sep 18, 2026
Reserved
Apr 7, 2026

Read the record on cve.org

Description

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LCISA-ADP
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-281 Improper Preservation of Permissions

Affected Products

ProductVersions
golang.org/x/crypto/sshgolang.org/x/crypto
  • before 0.52.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.