Authentication Callback Vulnerability in Go Programming Language

CVE-2026-56854

What is CVE-2026-56854?

An issue in Go's authentication process allows for insufficient validation of remote addresses in various callbacks. While the enforcement of source-address restrictions is correctly applied in PublicKeyCallback and VerifiedPublicKeyCallback, other callbacks such as PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin were not subjected to this restriction check, leaving them vulnerable. This oversight may lead to unauthorized access, as permissions based on client addresses could be ignored, potentially compromising application security.

References