Vulnary
← back to the feed
Critical· 10

CVE-2026-46595

CVE-2026-46595 is a critical authorization flaw in the Go programming language's crypto package, related to SSH server configurations. It stems from a previously patched issue where source-address validation could be skipped if a non-public-key callback was used, and the new CVE indicates the underlying problem remains or recurs.

publishedMay 22, 2026
last modifiedAug 4, 2026
sourcesNVD
severity · cvss
10
critical · how bad it is
exploitation · epss
<1%
40th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 1, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Applications or services using the Go (Golang) crypto package for SSH server functionality, particularly those with configurations involving non-public-key callbacks.

02

Real-world impact

An attacker could potentially bypass authorization controls on affected SSH servers built with the vulnerable Go crypto package, allowing unauthorized access depending on how the server is configured.

03

Why this severity

CVSS score 10 out of 10 (critical): the flaw is exploitable over a network with no privileges or user interaction required, and can lead to a full loss of confidentiality and integrity.

04

What to do about it

no official fix yet
interim mitigations
  • ›No official fix is documented in the provided sources. Until a patch is released, review SSH server configurations using the Go crypto package and avoid passing non-public-key callbacks that could skip source-address validation.

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

  1. May 22, 2026 · May 22, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Aug 4, 2026 · 7h ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactLow
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →