google-guest-agent

3 results · Clear filters · Feed

• Critical 10.0
  CVE-2026-46595 Public exploit

  Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

  Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Critical 9.1
  CVE-2026-33186 Public exploit

  gRPC-Go has an authorization bypass via missing leading slash in :path

  gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

  grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go
  Mar 20, 2026
• Critical 9.1
  CVE-2024-45337 Public exploit

  Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

  Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

  golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 11, 2024