Read the docs
TI-2026-40994 Aliases CVE-2026-56854GHSA-gjhq-gjfw-99mq

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 13 fixed, 31 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh (golang.org/x/crypto): 0.55.0Red Hat: 26 advisoriesRed Hat: 13 fixed, 31 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygolang.org/x/crypto/sshbefore 0.55.00.55.0Patch availableCNA
  • golang.org/x/crypto/ssh VendorGo standard library Affected before 0.55.0 Fixed in 0.55.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:golang:crypto:*:*:*:*:*:*:*:*——Go standard library

Remediation

  • Fix · CNA golang.org/x/crypto/ssh (golang.org/x/crypto) Fixed in 0.55.0

Red Hat 26 advisories

  • RHSA-2026:92307 Released 2026-10-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:85247 Released 2026-10-19 · Red Hat rating Important
    DevWorkspace Operator 1.0.0 release.
    • DevWorkspace Operator 1.0 registry.redhat.io/devworkspace/devworkspace-rhel9-operator
Show 23 more Red Hat advisories
  • RHSA-2026:83601 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/ctlog-monitor-rhel9, registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:83597 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:83593 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.0.3 - GA Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/policy-controller-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:77273 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.8 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:77269 Released 2026-10-07 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.5 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:70829 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:70828 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:70824 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:69945 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.2
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:69942 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.9.1
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +3
  • RHSA-2026:69928 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.2
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:69925 Released 2026-09-22 · Red Hat rating Important
    Red Hat OpenShift Builds 1.9.1
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +3
  • RHSA-2026:69268 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.11.1 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2Affected—
Confidential Compute AttestationAffected—
External Secrets Operator for Red Hat OpenShiftAffected—
ExternalDNS OperatorAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Multicluster Engine for KubernetesAffected—
OpenShift API for Data ProtectionAffected—
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffected—
Red Hat Advanced Cluster Management for Kubernetes 2Affected—
Red Hat Advanced Cluster Security 4Affected—
Red Hat Edge Manager 1Affected—
Red Hat Enterprise Linux 10Affected—
Red Hat Enterprise Linux 8Affected—
Red Hat Enterprise Linux 9Affected—
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5Affected—
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4Affected—
Red Hat OpenShift for Windows ContainersAffected—
Red Hat OpenShift on AWSAffected—
Red Hat OpenStack Platform 16.2Affected—
Red Hat OpenStack Platform 17.1Affected—
Red Hat OpenStack Platform 18.0Affected—
Red Hat Quay 3Affected—
Red Hat Trusted Artifact SignerAffectedNo fix yet
Security Profiles OperatorAffected—
Zero Trust Workload Identity ManagerAffected—
Zero Trust Workload Identity Manager - Tech PreviewAffected—
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
DevWorkspace Operator 1.0Fixed RHSA-2026:85247
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:92307
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:69945
Red Hat OpenShift Builds 1.9.2Fixed RHSA-2026:69925
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:77273
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:77269
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:69268
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:70824, RHSA-2026:70828, RHSA-2026:70829
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83593, RHSA-2026:83597, RHSA-2026:83598, RHSA-2026:83601
Not affected: 20 products
  • Cert Manager support for Red Hat OpenShift release 1.20
  • Cryostat 4 on RHEL 9
  • DevWorkspace Operator 1.0
  • Multicluster Engine for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Builds 1.9.2
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift distributed tracing 3.11
  • Red Hat Openshift Data Foundation 4
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56854
  2. 2026-10-03 Alias added: GHSA-gjhq-gjfw-99mq
  3. 2026-10-07 Fix available: RHSA-2026:77269 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:77273 · Red Hat
  5. 2026-10-07 Fix available: Red Hat OpenShift GitOps 1.20, Red Hat OpenShift GitOps 1.21 · Red Hat
  6. 2026-10-08 Affected versions changed · Red Hat
  7. 2026-10-09 Fix available: Red Hat OpenShift distributed tracing 3.11.2 · Red Hat
  8. 2026-10-13 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  11. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
  12. 2026-10-16 Fix available: RHSA-2026:83593 · Red Hat
  13. 2026-10-16 Fix available: RHSA-2026:83597 · Red Hat
  14. 2026-10-16 Fix available: RHSA-2026:83601 · Red Hat
  15. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  16. 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
  17. 2026-10-20 Fix available: RHSA-2026:85247 · Red Hat
  18. 2026-10-20 Fix available: DevWorkspace Operator 1.0 · Red Hat
  19. 2026-10-23 Fix available: Red Hat OpenShift distributed tracing 3.11.3 · Red Hat
  20. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3, Red Hat OpenShift Builds 1.9.2 · Red Hat
  21. 2026-10-26 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  22. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  23. 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
  24. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  25. 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat
  26. 2026-10-30 Affected versions changed · Red Hat
  27. 2026-11-06 Affected versions changed · Red Hat

References

Other 3

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences