CVE-2026-56854

Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.33%• Percentile: 26%

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• chainguard•aactl

  < 0.4.12-r73

• chainguard•acm-controller

  < 0

• chainguard•acm-controller-fips

  < 0

• chainguard•act

  < 0

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•age

  < 0

• chainguard•age-fips

  < 0

• chainguard•agentbeat

  < 0

• chainguard•agentbeat-fips

  < 0

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent

  < 0

• chainguard•amazon-cloudwatch-agent-fips

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-ssm-agent

  < 0

• chainguard•amazon-ssm-agent-ecs-exec

  < 0

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 0

• chainguard•amazon-ssm-agent-fips

  < 0

• chainguard•apache-exporter

  < 0

• chainguard•apko

  < 0

• chainguard•apko-fips

  < 0

• chainguard•apm-server-8.19

  < 0

• chainguard•apm-server-9.2

  < 0

• chainguard•apm-server-9.3

  < 0

• chainguard•apm-server-9.4

  < 0

• chainguard•apm-server-9.5

  < 0

• chainguard•application-gateway-kubernetes-ingress

  < 0

• chainguard•application-gateway-kubernetes-ingress-fips

  < 0

• chainguard•apply-cve-bump

  < 0

• chainguard•argo-cd-3.1

  < 0

• chainguard•argo-cd-3.1-compat

  < 0

• chainguard•argo-cd-3.2

  < 0

• chainguard•argo-cd-3.2-compat

  < 0

• chainguard•argo-cd-3.3

  < 0

• chainguard•argo-cd-3.3-compat

  < 0

• chainguard•argo-cd-3.4

  < 0

• chainguard•argo-cd-3.4-compat

  < 0

• chainguard•argo-cd-3.5

  < 0

• chainguard•argo-cd-3.5-compat

  < 0

• chainguard•argo-cd-fips-3.1

  < 3.1.16-r13

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.16-r13

• chainguard•argo-cd-fips-3.2

  < 3.2.12-r22

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.12-r22

• chainguard•argo-cd-fips-3.3

  < 3.3.14-r6

• chainguard•argo-cd-fips-3.3-compat

  < 3.3.14-r6

• chainguard•argo-cd-fips-3.4

  < 3.4.8-r2

• chainguard•argo-cd-fips-3.4-compat

  < 3.4.8-r2

• chainguard•argo-cd-fips-3.5

  < 3.5.2-r3

• chainguard•argo-cd-fips-3.5-compat

  < 3.5.2-r3

Showing first 50 affected entries in server-rendered view.

References (8)

• https://go.dev/issue/80213
• https://go.dev/cl/797040
• https://pkg.go.dev/vuln/GO-2026-6303
• https://security-tracker.debian.org/tracker/CVE-2026-56854
• https://ubuntu.com/security/CVE-2026-56854
• https://www.cve.org/CVERecord?id=CVE-2026-56854
• https://github.com/golang/go/issues/80213
• https://www.suse.com/security/cve/CVE-2026-56854