Skip to content
OpenAdvisories
High ALAS2-2026-3947 1 CVE

Important: rclone security update (Amazon Linux 2)

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56854: The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 rclone 0:1.55.1-1.amzn2.0.11
Amazon Linux · 2 rclone-debuginfo 0:1.55.1-1.amzn2.0.11

Vulnerabilities 1

  • High 7.5
    CVE-2026-56854

    Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

    The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, K…

    golang.org/x/crypto golang.org/x/crypto/ssh kubescape skaffold Debian Ubuntu Wolfi Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56854.html