CVE-2026-46595 golang.org/x/crypto CVE debrief

Who should care

Operators and developers running Go-based SSH servers, especially deployments that rely on source-address restrictions and custom authentication callbacks. Security teams reviewing authentication controls for internet-facing services should also pay attention.

Technical summary

The provided record indicates a logic gap in SSH server authorization flow: if the server uses a callback path other than public key authentication, the source-address validation step may not run. That can weaken an intended access-control boundary because address-based checks are not enforced consistently across all callback types. The issue appears related to an earlier authorization-bypass fix, suggesting incomplete coverage rather than a brand-new control.

Defensive priority

High for exposed Go SSH services that use source-address validation or custom auth callbacks; medium otherwise. Treat as higher priority if the service is reachable from untrusted networks or if address-based restrictions are part of the security model.

Recommended defensive actions

• Review SSH server configurations that use source-address validation together with non-public-key authentication callbacks.
• Check whether your Go dependency set includes the affected SSH server code path referenced by the Go advisory GO-2026-5023.
• Apply the vendor-provided fix or upgrade path referenced in the linked Go advisory and release announcement.
• Verify that authorization checks are enforced uniformly across all authentication callback types, not just public-key flows.
• Re-test any compensating controls or network allowlists that were assumed to be backed by SSH-layer source-address validation.

Evidence notes

This debrief is based only on the supplied CVE record, its NVD metadata, and the linked official Go references. The NVD record lists [email protected] references to a code change (go.dev/cl/781642), an issue tracker entry (go.dev/issue/79570), an announcement post, and pkg.go.dev/vuln/GO-2026-5023. No CVSS score, CPEs, or weakness identifiers were provided in the source corpus. Vendor attribution is low-confidence and should be treated cautiously; the only clear vendor signal in the supplied data is Go-related.

Official resources