NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2026-46595: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

criticalCVSS 3.1 10.0GHSA-x527-x647-q7gg

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Published Jun 25, 2026 · Updated Jul 17, 2026

Affected packages

golang.org/x/crypto

Ecosystem
Go
Affected
< 0.52.0
Fixed in
0.52.0
Check
go list -m golang.org/x/crypto

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries