CVE-2026-56854

EUVD-2026-67741

28.08.2026, 16:18

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 36.16%

Debian Releases

Debian Product

Codename

golang-go.crypto

bookworm	postponed
forky	1:0.56.0-1 fixed
sid	1:0.56.0-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

golang-go.crypto

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

snapd

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

lxd

bionic	needs-triage
focal	not-affected
jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

google-guest-agent

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

alloy

suse enterprise desktop 15 SP7	1.19.2-150700.15.29.1 fixed
suse enterprise sap 15 SP7	1.19.2-150700.15.29.1 fixed
suse enterprise server 15 SP7	1.19.2-150700.15.29.1 fixed

amazon-ssm-agent

suse enterprise sap 15 SP4	3.3.5390.0-150000.5.43.1 fixed
suse enterprise sap 15 SP5	3.3.5390.0-150000.5.43.1 fixed
suse enterprise sap 15 SP6	3.3.5390.0-150000.5.43.1 fixed
suse enterprise sap 15 SP7	3.3.5390.0-150000.5.43.1 fixed
suse enterprise server 15 SP4	3.3.5390.0-150000.5.43.1 fixed
suse enterprise server 15 SP5	3.3.5390.0-150000.5.43.1 fixed
suse enterprise server 15 SP6	3.3.5390.0-150000.5.43.1 fixed
suse enterprise server 15 SP7	3.3.5390.0-150000.5.43.1 fixed

apptainer

suse enterprise sap 15 SP6	1.5.3-150600.4.43.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.4.43.1 fixed

apptainer-sle15_6

suse enterprise sap 15 SP6	1.5.3-150600.4.43.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.4.43.1 fixed

containerized-data-importer-manifests

suse enterprise sap 15 SP7	1.64.0-150700.9.14.1 fixed
suse enterprise server 15 SP7	1.64.0-150700.9.14.1 fixed

cosign

suse enterprise desktop 15 SP7	3.1.3-150400.3.57.1 fixed
suse enterprise sap 15 SP4	3.1.3-150400.3.57.1 fixed
suse enterprise sap 15 SP5	3.1.3-150400.3.57.1 fixed
suse enterprise sap 15 SP6	3.1.3-150400.3.57.1 fixed
suse enterprise sap 15 SP7	3.1.3-150400.3.57.1 fixed
suse enterprise server 15 SP4	3.1.3-150400.3.57.1 fixed
suse enterprise server 15 SP5	3.1.3-150400.3.57.1 fixed
suse enterprise server 15 SP6	3.1.3-150400.3.57.1 fixed
suse enterprise server 15 SP7	3.1.3-150400.3.57.1 fixed

cosign-bash-completion

suse enterprise desktop 15 SP7	3.1.3-150400.3.57.1 fixed
suse enterprise sap 15 SP7	3.1.3-150400.3.57.1 fixed
suse enterprise server 15 SP7	3.1.3-150400.3.57.1 fixed

cosign-zsh-completion

suse enterprise desktop 15 SP7	3.1.3-150400.3.57.1 fixed
suse enterprise sap 15 SP7	3.1.3-150400.3.57.1 fixed
suse enterprise server 15 SP7	3.1.3-150400.3.57.1 fixed

google-guest-agent

suse enterprise sap 15 SP4	20260903.01-150000.1.85.1 fixed
suse enterprise sap 15 SP5	20260903.01-150000.1.85.1 fixed
suse enterprise sap 15 SP6	20260903.01-150000.1.85.1 fixed
suse enterprise sap 15 SP7	20260903.01-150000.1.85.1 fixed
suse enterprise server 15 SP4	20260903.01-150000.1.85.1 fixed
suse enterprise server 15 SP5	20260903.01-150000.1.85.1 fixed
suse enterprise server 15 SP6	20260903.01-150000.1.85.1 fixed
suse enterprise server 15 SP7	20260903.01-150000.1.85.1 fixed

google-osconfig-agent

suse enterprise sap 15 SP4	20260911.00-150000.1.67.1 fixed
suse enterprise sap 15 SP5	20260911.00-150000.1.67.1 fixed
suse enterprise sap 15 SP6	20260911.00-150000.1.67.1 fixed
suse enterprise sap 15 SP7	20260911.00-150000.1.67.1 fixed
suse enterprise server 15 SP4	20260911.00-150000.1.67.1 fixed
suse enterprise server 15 SP5	20260911.00-150000.1.67.1 fixed
suse enterprise server 15 SP6	20260911.00-150000.1.67.1 fixed
suse enterprise server 15 SP7	20260911.00-150000.1.67.1 fixed

Amazon Linux Releases

Amazon Package

Release

rclone

Amazon Linux 2	0:1.55.1-1.amzn2.0.11 fixed
Amazon Linux 2023	0:1.75.1-1.amzn2023 fixed

rclone-debuginfo

Amazon Linux 2	0:1.55.1-1.amzn2.0.11 fixed
Amazon Linux 2023	0:1.75.1-1.amzn2023 fixed

rclone-debugsource

Amazon Linux 2023

0:1.75.1-1.amzn2023

fixed

Common Weakness Enumeration

CWE-863 - Incorrect Authorization
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References

https://go.dev/cl/797040

https://go.dev/issue/80213

https://pkg.go.dev/vuln/GO-2026-6303