Skip to content
OpenAdvisories
High · 7.5 CVE-2026-56854 EUVD-2026-67741GHSA-gjhq-gjfw-99mqGO-2026-6303

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Published Aug 28, 2026 · Updated Aug 28, 2026 · Assigned by Go

Vendor: golang.org/x/crypto Product: golang.org/x/crypto/ssh Package: aactl Package: argocd-image-updater Package: cert-manager-1.20 Package: cert-manager-1.20-crds Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: chisel Package: cilium-1.19 Package: cilium-1.19-operator-generic Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: datadog-agent-7.79 Package: external-dns-0.21 Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: flux-image-automation-controller Package: flux-notification-controller Package: flux-source-controller Package: frp Package: fscrypt Package: gitea Package: gitness Package: golang-go.crypto Package: golang-go.crypto Package: golang.org/x/crypto Package: google-guest-agent Package: helm-3 Package: k3s-1.32 Package: k3s-static-1.32 Package: k9s Package: kaf Package: kine Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubescape Package: kubevela-vela-cli Package: kubevela-vela-core Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: loki-3.6-loki-canary Package: lxd Package: minio Package: nerdctl Package: opentelemetry-collector Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-operator-iamguarded-compat Package: rancher-agent-2.13 Package: rclone Package: sftpgo Package: skaffold Package: snapd Package: snyk-cli Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: tailscale Package: telegraf-1.38 Package: xeol Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Affected products

VendorProductAffectedFixed
golang.org/x/crypto golang.org/x/crypto/ssh < 0.55.0 0.55.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-go.crypto 1:0.55.0-1 —
Debian 13 golang-go.crypto No fix yet —
Debian 12 golang-go.crypto No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 snapd +2 No fix yet —
Ubuntu 26.04 LTS google-guest-agent No fix yet —
Ubuntu 24.04 LTS google-guest-agent No fix yet —
Ubuntu 22.04 LTS google-guest-agent No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS golang-go.crypto No fix yet —
Ubuntu Pro 24.04 LTS golang-go.crypto No fix yet —
Ubuntu Pro 22.04 LTS golang-go.crypto No fix yet —
Ubuntu Pro 20.04 LTS snapd +2 No fix yet —
Ubuntu Pro 18.04 LTS lxd +3 No fix yet —
Ubuntu Pro 16.04 LTS lxd +3 No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.19.2-150700.15.29.1 SUSE-SU-2026:4408-1
SLES 15 SP7 amazon-ssm-agent 3.3.5390.0-150000.5.43.1 SUSE-SU-2026:4372-1
SLES 15 SP7 apptainer 1.5.3-150600.4.43.1 SUSE-SU-2026:4308-1
SLES 15 SP7 containerized-data-importer 1.64.0-150700.9.14.1 SUSE-SU-2026:4209-1
SLES 15 SP7 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES 15 SP7 google-guest-agent 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1
SLES 15 SP7 google-osconfig-agent 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1
SLES 15 SP7 kubevirt 1.7.4-150700.3.42.1 SUSE-SU-2026:5167-1
SLES 15 SP6 amazon-ssm-agent 3.3.5390.0-150000.5.43.1 SUSE-SU-2026:4372-1
SLES 15 SP6 apptainer 1.5.3-150600.4.43.1 SUSE-SU-2026:4308-1
SLES 15 SP6 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES 15 SP6 google-guest-agent 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1
SLES 15 SP6 google-osconfig-agent 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1
SLES 15 SP5 amazon-ssm-agent 3.3.5390.0-150000.5.43.1 SUSE-SU-2026:4372-1
SLES 15 SP5 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES 15 SP5 google-guest-agent 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1
SLES 15 SP5 google-osconfig-agent 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1
SLES 15 SP5 terraform-provider-aws 3.11.0-150200.6.29.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-azurerm 2.32.0-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-external 2.0.0-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-google 3.43.0-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-helm 2.9.0-150200.6.34.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-kubernetes 1.13.2-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-local 2.0.0-150200.6.30.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-null 3.0.0-150200.6.32.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-random 3.0.0-150200.6.26.2 SUSE-SU-2026:4628-1
SLES 15 SP5 terraform-provider-tls 3.0.0-150200.5.26.2 SUSE-SU-2026:4628-1
SLES 15 SP4 amazon-ssm-agent 3.3.5390.0-150000.5.43.1 SUSE-SU-2026:4372-1
SLES 15 SP4 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES 15 SP4 google-guest-agent 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1
SLES 15 SP4 google-osconfig-agent 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1
SLES 15 SP4 terraform-provider-aws 3.11.0-150200.6.29.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-azurerm 2.32.0-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-external 2.0.0-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-google 3.43.0-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-helm 2.9.0-150200.6.34.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-kubernetes 1.13.2-150200.6.23.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-local 2.0.0-150200.6.30.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-null 3.0.0-150200.6.32.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-random 3.0.0-150200.6.26.2 SUSE-SU-2026:4628-1
SLES 15 SP4 terraform-provider-tls 3.0.0-150200.5.26.2 SUSE-SU-2026:4628-1
SLES 12 amazon-ssm-agent 3.3.5390.0-4.52.1 SUSE-SU-2026:4286-1
SLES 12 google-guest-agent 20260903.01-1.75.1 SUSE-SU-2026:4272-1
SLES 12 google-osconfig-agent 20260911.00-1.60.1 SUSE-SU-2026:4292-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.19.2-160000.1.1 SUSE-SU-2026:24148-1
SLES for SAP 16.0 cosign 3.1.3-160000.1.1 SUSE-SU-2026:24213-1
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260902T191204-160000.1.1 SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1
SLES for SAP 16.0 helm 4.3.0-160000.1.1 SUSE-SU-2026:23984-1
SLES for SAP 15 SP6 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES for SAP 15 SP5 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES for SAP 15 SP4 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLES 16.0 alloy 1.19.2-160000.1.1 SUSE-SU-2026:24148-1
SLES 16.0 cosign 3.1.3-160000.1.1 SUSE-SU-2026:24213-1
SLES 16.0 govulncheck-vulndb 0.0.20260902T191204-160000.1.1 SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1
SLES 16.0 helm 4.3.0-160000.1.1 SUSE-SU-2026:23984-1
SLE Micro 6.2 helm 4.3.0-160000.1.1 SUSE-SU-2026:23973-1
SLE Micro 6.1 google-guest-agent 20260903.01-slfo.1.1_1.1 SUSE-SU-2026:23745-1, SUSE-SU-2026:23736-1
SLE Micro 6.1 google-osconfig-agent 20260908.00-slfo.1.1_1.1 SUSE-SU-2026:23924-1, SUSE-SU-2026:23739-1
SLE Micro 6.1 helm 4.3.0-slfo.1.1_1.1 SUSE-SU-2026:24282-1
SLE Micro 6.0 google-guest-agent 20260903.01-1.1 SUSE-SU-2026:23874-1, SUSE-SU-2026:23831-1
SLE Micro 6.0 google-osconfig-agent 20260908.00-2.1 SUSE-SU-2026:23876-1, SUSE-SU-2026:23841-1
SLE Micro 5.5 google-guest-agent 20260903.01-150000.1.85.1 SUSE-SU-2026:4270-1
SLE Micro 5.5 google-osconfig-agent 20260911.00-150000.1.67.1 SUSE-SU-2026:4293-1
SLE HPC 15 SP5 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
SLE HPC 15 SP4 cosign 3.1.3-150400.3.57.1 SUSE-SU-2026:4392-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.19.2-1.1 openSUSE-SU-2026:11803-1
openSUSE Tumbleweed amazon-ssm-agent 3.3.5390.0-1.1 openSUSE-SU-2026:11811-1
openSUSE Tumbleweed apptainer 1.5.3-4.1 openSUSE-SU-2026:11830-1
openSUSE Tumbleweed cloudflared 2026.9.1-1.1 openSUSE-SU-2026:11813-1
openSUSE Tumbleweed containerized-data-importer1.65 1.65.0-3.1 openSUSE-SU-2026:11731-1
openSUSE Tumbleweed containerized-data-importer1.66 1.66.1-1.1 openSUSE-SU-2026:11732-1
openSUSE Tumbleweed google-guest-agent 20260903.00-1.1 openSUSE-SU-2026:11699-1
openSUSE Tumbleweed google-osconfig-agent 20260908.00-2.1 openSUSE-SU-2026:11751-1
openSUSE Tumbleweed kubevirt1.8 1.8.4-7.1 openSUSE-SU-2026:12241-1
openSUSE Tumbleweed kubevirt1.9 1.9.0-3.1 openSUSE-SU-2026:11752-1
openSUSE Tumbleweed rclone 1.75.1-1.1 openSUSE-SU-2026:11727-1
openSUSE Tumbleweed zk 0.15.7-1.1 openSUSE-SU-2026:12258-1
openSUSE Leap 16.0 alloy 1.19.2-160000.1.1 openSUSE-SU-2026:22032-1
openSUSE Leap 16.0 amazon-ssm-agent 3.3.5390.0-160000.1.1 openSUSE-SU-2026:21884-1
openSUSE Leap 16.0 apptainer 1.5.3-bp160.4.1 openSUSE-SU-2026:21927-1
openSUSE Leap 16.0 cloudflared 2026.9.1-bp160.1.1 openSUSE-SU-2026:21924-1
openSUSE Leap 16.0 containerized-data-importer1.65 1.65.0-160000.3.1 openSUSE-SU-2026:21824-1
openSUSE Leap 16.0 cosign 3.1.3-160000.1.1 openSUSE-SU-2026:22064-1
openSUSE Leap 16.0 gh 2.100.0-bp160.1.1 openSUSE-SU-2026:21861-1
openSUSE Leap 16.0 google-guest-agent 20260903.01-160000.1.1 openSUSE-SU-2026:21879-1
openSUSE Leap 16.0 google-osconfig-agent 20260911.00-160000.1.1 openSUSE-SU-2026:21882-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260902T191204-160000.1.1 openSUSE-SU-2026:21812-1
openSUSE Leap 16.0 hauler 2.1.0-bp160.2.1 openSUSE-SU-2026:21841-1, openSUSE-SU-2026:21816-1
openSUSE Leap 16.0 helm 4.3.0-160000.1.1 openSUSE-SU-2026:21983-1
openSUSE Leap 16.0 keybase-client 6.6.3-bp160.3.1 openSUSE-SU-2026:21846-1
openSUSE Leap 16.0 rclone 1.75.1-bp160.1.1 openSUSE-SU-2026:21999-1
openSUSE Leap 16.0 trivy 0.74.0-160000.2.1 openSUSE-SU-2026:21835-1, openSUSE-SU-2026:21801-1
openSUSE Leap 16.0 zk 0.15.6-bp160.2.1 openSUSE-SU-2026:21814-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 rclone 1.75.1-1.amzn2023 ALAS2023-2026-3129
Amazon Linux 2 rclone 1.55.1-1.amzn2.0.11 ALAS2-2026-3947

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r73 —
Wolfi rolling argocd-image-updater 1.3.0-r4 —
Wolfi rolling cert-manager-1.20 +4 1.20.3-r14 —
Wolfi rolling cert-manager-1.20-crds 1.20.3-r18 —
Wolfi rolling chisel 1.12.0-r0 —
Wolfi rolling cilium-1.19 1.19.7-r5 —
Wolfi rolling cilium-1.19-operator-generic 1.19.7-r7 —
Wolfi rolling containerd-1 1.7.34-r11 —
Wolfi rolling containerd-2 +1 2.3.4-r7 —
Wolfi rolling datadog-agent-7.79 7.79.2-r18 —
Wolfi rolling external-dns-0.21 0.21.0-r21 —
Wolfi rolling falco-no-driver 0.44.1-r6 —
Wolfi rolling flux-2.7 2.7.5-r35 —
Wolfi rolling flux-2.8 2.8.8-r19 —
Wolfi rolling flux-2.9 2.9.4-r5 —
Wolfi rolling flux-image-automation-controller 1.2.4-r5 —
Wolfi rolling flux-notification-controller 1.9.3-r5 —
Wolfi rolling flux-source-controller 1.9.4-r4 —
Wolfi rolling frp 0.71.0-r3 —
Wolfi rolling fscrypt 0.3.7-r1 —
Wolfi rolling gitea 1.27.2-r4 —
Wolfi rolling gitness 3.3.0-r34 —
Wolfi rolling helm-3 3.21.4-r3 —
Wolfi rolling k3s-1.32 +1 No fix yet —
Wolfi rolling k9s 0.51.0-r13 —
Wolfi rolling kaf 0.2.14-r14 —
Wolfi rolling kine 0.17.0-r1 —
Wolfi rolling kubeadm-1.34 +6 1.34.11-r3 —
Wolfi rolling kubeadm-1.35 +6 1.35.8-r3 —
Wolfi rolling kubeadm-1.36 +6 1.36.4-r4 —
Wolfi rolling kubectl-bash-completion-1.35 +3 1.35.8-r6 —
Wolfi rolling kubernetes-dashboard 7.14.0-r17 —
Wolfi rolling kubescape 4.0.12-r8 —
Wolfi rolling kubevela-vela-cli +1 1.11.0-r9 —
Wolfi rolling kyverno-1.17 1.17.2-r35 —
Wolfi rolling kyverno-1.18 +5 1.18.2-r10 —
Wolfi rolling kyverno-cli-1.17 +4 1.17.2-r31 —
Wolfi rolling loki-3.6-loki-canary 3.6.16-r1 —
Wolfi rolling minio 0.20260717.120751-r10 —
Wolfi rolling nerdctl 2.3.5-r9 —
Wolfi rolling opentelemetry-collector 0.159.0-r3 —
Wolfi rolling prometheus-operator +1 0.93.1-r3 —
Wolfi rolling prometheus-operator-iamguarded-compat 0.94.0-r0 —
Wolfi rolling rancher-agent-2.13 2.13.9-r4 —
Wolfi rolling rclone 1.75.0-r6 —
Wolfi rolling sftpgo 2.7.5-r7 —
Wolfi rolling skaffold 2.24.0-r5 —
Wolfi rolling snyk-cli 1.1307.0-r1 —
Wolfi rolling spire-agent +2 1.15.3-r1 —
Wolfi rolling tailscale 1.102.3-r1 —
Wolfi rolling telegraf-1.38 1.38.4-r23 —
Wolfi rolling xeol 0.10.8-r55 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/crypto < 0.55.0 0.55.0 GO-2026-6303

Advisories 50

References