Vulnerability GO-2026-5014
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 22, 2026 at 02:08 AM UTC
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
v0.1.0 - v0.51.0
v0.1.0 - v0.51.0
Summary
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
Details
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6354
v0.1.0 - v0.55.0 GO-2026-6354
Unknown
2 months ago
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
v0.1.0 - v0.55.0 GO-2026-6355
v0.1.0 - v0.55.0 GO-2026-6355
Unknown
2 months ago
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
v0.1.0 - v0.54.0 GO-2026-6303
v0.1.0 - v0.54.0 GO-2026-6303
Unknown
4 months ago
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
v0.1.0 - v0.58.0 GO-2026-5932
v0.1.0 - v0.58.0 GO-2026-5932
Critical
4 months ago
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
v0.1.0 - v0.51.0 GHSA-x527-x647-q7gg
Impacted packages
Timeline
Published
5 months ago
May 22, 2026 at 02:08 AM UTC
Fixed (v0.52.0)
5 months ago
May 22, 2026 at 12:26 AM UTC
Last Modified
6 hours ago
November 14, 2026 at 01:12 PM UTC