CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security relevant authorization decisions, an attacker with a valid key could bypass network-based access controls to gain additional privileges.

This vulnerability severity is Important due to the requirement that an attacker already have a valid private key. A flaw in golang.org/x/crypto/ssh allows remote attackers to bypass source-address restrictions for certain authentication methods. This would allow an attacker to use a valid key for gaining additional privileges outside of the bounds of the network-based access controls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.