CVE-2026-40884: goshs: Empty-username SFTP password authentication bypass in goshs
Vulnerability summary
CVE-2026-40884 is a critical (CVSS 9.8) vulnerability in goshs. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 21-04-2026PublishedVulnerability first disclosed.
- 22-04-2026Last modifiedVulnerability information updated.
Description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
Increase +0.17 pp
From 0.48% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundGoshs
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Github.com/patrickhener1 product
- goshs≤ 1.1.4 | All versions (No fix recorded)
Github.com/patrickhener/goshs1 product
- v2< 2.0.0
Goshs1 product
- goshs< 2.0.0 | 2.0.0:beta1 | 2.0.0:beta2 | 2.0.0:beta3 | 2.0.0:beta4 | 2.0.0:beta5
Patrickhener1 product
- goshs< 2.0.0-beta.6
4 vendors · 4 products
References
3 links- github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcvX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
