CVE-2026-39828

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Score
CVSS 3.1 8.8 High
Status
Modified - security@golang.org
Published
2026-05-22
Last modified
2026-09-18
Weaknesses
CWE-281, CWE-295

Affected products

References

 
 
© AVABIS GmbH privacypolicy about