CVE-2026-39828 golang.org/x/crypto CVE debrief

Who should care

Defenders responsible for SSH server configurations, especially those using certificate-based authentication, should assess exposure and prioritize verification of SSH server configurations. This includes reviewing SSH server configurations, verifying Permissions handling in SSH server authentication callbacks, and assessing exposure to potential attacks.

Why it matters

A vulnerability in the golang.org/x/crypto/ssh package could allow an attacker to potentially drop certificate restrictions, such as force-command, after a second factor succeeded. Defenders should assess exposure and prioritize verification of SSH server configurations.

• Verification of SSH server configurations for certificate-based authentication
• Potential dropping of certificate restrictions such as force-command
• Assessment of exposure to potential attacks
• Prioritization of vendor-provided patches or updates

Technical summary

The golang.org/x/crypto/ssh package has a vulnerability where an SSH server authentication callback returning PartialSuccessError with non-nil Permissions could silently discard those permissions, potentially dropping certificate restrictions such as force-command after a second factor succeeded. This issue affects SSH server configurations, particularly those using certificate-based authentication. Defenders should assess exposure and prioritize verification of SSH server configurations, especially those using certificate-based authentication.

Defensive priority

Defenders should assess exposure and prioritize verification of SSH server configurations, especially those using certificate-based authentication.

Recommended defensive actions

• Review SSH server configurations for certificate-based authentication
• Verify Permissions handling in SSH server authentication callbacks
• Assess exposure to potential attacks
• Apply vendor-provided patches or updates
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.