CVE-2026-46595: Critical Authentication Bypass in golang.org/x/crypto/ssh VerifiedPublicKeyCallback (CVSS 10.0)

Vulnerability Overview

CVE-2026-46595 is a critical authentication bypass (CVSS 10.0, CWE-863: Incorrect Authorization) in the Go extended cryptography library golang.org/x/crypto/ssh. When an SSH server implementation uses the VerifiedPublicKeyCallback mechanism, the library fails to enforce permission checks after the callback returns. An attacker can exploit this logic gap to authenticate to an affected SSH server without possessing the private key material that the server believes it has verified — effectively bypassing the entire public-key authentication handshake.

This vulnerability is a regression and variant of the previously disclosed CVE-2024-45337, indicating that the original fix was incomplete and that the underlying authorization enforcement flaw persisted across library versions.

Affected Software

• Vendor: Go (golang.org/x)
• Package: golang.org/x/crypto/ssh
• Affected versions: all releases prior to 0.52.0

Any Go application that embeds an SSH server using VerifiedPublicKeyCallback and links against a vulnerable version of this package is at risk. This includes custom SSH gateways, bastion hosts, CI/CD automation servers, and infrastructure tooling written in Go.

Exploitation Status

A public proof-of-concept (PoC) is available as of disclosure on 2026-06-25. This materially lowers the barrier to exploitation: opportunistic attackers and automated scanners can weaponize this vulnerability without specialized knowledge. Defenders should treat this as actively exploitable and prioritize detection and patching immediately. No patch date has been confirmed at the time of writing — assume vulnerable versions remain unpatched in many environments.

Detection Coverage

Our detection engineering team has shipped behavioral and log-based detections across all major SIEM platforms to identify exploitation attempts against this vulnerability. Coverage includes:

• Microsoft Sentinel (KQL) — queries targeting anomalous SSH authentication successes where public-key negotiation completes without expected key material evidence, correlated against known-bad source patterns.
• Splunk (SPL) — searches across SSH daemon logs for authentication events that bypass normal key-validation sequences, with threshold-based alerting for rapid successive attempts.
• Elastic (EQL) — event sequence rules correlating SSH session initiation with missing or malformed key verification audit trail entries.
• IBM QRadar (AQL) — queries against normalized SSH authentication flows flagging permission-check bypass indicators.
• Sumo Logic — log search and signal rules targeting VerifiedPublicKeyCallback-related authentication anomalies in Go SSH server telemetry.
• Google Chronicle (YARA-L) — rules matching SSH authentication bypass behavioral patterns across UDM event streams.
• CrowdStrike (CQL) — custom query language detections targeting process and network telemetry from Go-based SSH server binaries exhibiting exploitation indicators.

All detections focus on the behavioral signature of the bypass: a successful SSH authentication event where the public-key exchange phase does not produce the audit artifacts expected when authorization is properly enforced.

Recommendations

• Upgrade golang.org/x/crypto to version 0.52.0 or later immediately in all affected Go projects.
• Audit your Go dependency graph (go list -m all | grep x/crypto) to identify transitive consumers of this package.
• Review SSH server implementations for use of VerifiedPublicKeyCallback and validate that authorization logic is enforced post-upgrade.
• Deploy the SIEM detections below and monitor for exploitation attempts while patching is in progress.

Full detection queries, MITRE ATT&CK mapping, and purple team test cases for CVE-2026-46595 are available on the CVE-2026-46595 detection page. Paid subscribers receive complete KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL rules alongside atomic red team test procedures.