CVE-2026-39828

Aliases:GO-2026-5014GHSA-45gg-vh54-h5m9
Advisory lineage Upstream: 0 Downstream: 47
Analyzed
Published: 22 May 2026, 02:31
Last modified:22 Jul 2026, 12:08

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.29% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 May 2026, 02:31
Published
Vulnerability first disclosed
22 Jul 2026, 12:08
Last Modified
Vulnerability information updated

Description

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 0.29%• Percentile: 21%

Techniques & Countermeasures

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

  • CWE-281•Improper Preservation of Permissions

    The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Systems

  • golang•crypto

    < 0.52.0

  • golang.org/x•crypto

    < 0.52.0

  • golang.org/x/crypto•ssh

    < 0.52.0

  • golang.org/x/crypto•golang.org/x/crypto/ssh

    < 0.52.0

References (42)