---
title: "CVE-2026-46595: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement"
url: https://erroneo.us/security/cve/CVE-2026-46595/
description: "CVE-2026-46595 (golang.org/x/crypto (Go)): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-05-22
date_modified: 2026-09-11
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-46595"
kev: false
cvss: 7.1
epss: 0.00503
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-46595: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 42: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 42% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes golang.org/x/crypto (Go) < 0.52.0, fixed in 0.52.0 . Check your lockfile, including transitive dependencies.

## What it is

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

## Affected packages

- Go `golang.org/x/crypto` < 0.52.0 → fixed: 0.52.0

## Affected products (CVE record)

- golang.org/x/crypto golang.org/x/crypto/ssh: < 0.52.0

## Severity

- CISA-ADP CVSS 3.1: 10 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L`
- redhat-SADP CVSS 3.1: 7.1 `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L`
- GitHub CVSS 3.1: 10.0 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.50% probability of exploitation activity in the next 30 days; percentile 42.

## Sources

- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41019)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:48151)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36796)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:54531)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:61314)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36808)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:66521)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:51033)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:59467)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:66022)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43692)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:30651)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:47737)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26546)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26547)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36207)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36651)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40945)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40118)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:33531)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:33524)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23262)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23264)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:37275)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:60520)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36648)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41036)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36820)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:37387)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42796)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36797)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:30650)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:59558)
- [GitHub Advisory GHSA-x527-x647-q7gg](https://github.com/advisories/GHSA-x527-x647-q7gg)
- [CVE.org record CVE-2026-46595](https://www.cve.org/CVERecord?id=CVE-2026-46595)
- [NVD entry CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595)
- [go.dev](https://go.dev/issue/79570)
- [groups.google.com](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [go.dev](https://go.dev/cl/781642)
- [pkg.go.dev](https://pkg.go.dev/vuln/GO-2026-5023)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-46595)
- [RHBZ#2480689](https://bugzilla.redhat.com/show_bug.cgi?id=2480689)
- [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json)
- [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2024-45337)

---
Source page: https://erroneo.us/security/cve/CVE-2026-46595/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt