VulnSocial

CVE-2026-46595Disclosure(golang / crypto)

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch golang crypto systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

golang CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-863CWE-303

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • crypto

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-05-30); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
golang
Products
crypto

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-30: 1Mentions · 2026-07-15: 1Mentions · 2026-08-06: 1Patch / Workaround · 2026-05-30: 1Patch / Workaround · 2026-07-15: 1Technical Details · 2026-05-30: 1Technical Details · 2026-07-15: 1Technical Details · 2026-08-06: 105-3007-1508-06
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-301
Disclosure1
2026-07-151
Patch1
2026-08-061
Disclosure1
Full discourse3 posts
  • Joey Romaine 🇺🇸 |=★=|@Tank23x0
    Disclosure

    CVE-2026-46595 just dropped. Critical severity — this one moves fast. http://golang.org/x/crypto/ssh: Invoking VerifiedPublicKeyCallback permissions skip enforcement Stay ahead of the curve.

    Post summary

    A newly disclosed CVE-2026-46595 in Go's crypto/ssh package is listed as critical, involving a permissions bypass when calling VerifiedPublicKeyCallback; no patch, PoC, or exploitation details are provided.

    0001071
    357 followersView on X
  • Azure Kamsaki oSushi@kamsakihiyuuma
    Patch

    Cloud Service Mesh 1.29.5-asm.12：Critical CVEを含む30件超の脆弱性修正【要アップデート】 Cloud Service Mesh 1.29.5-asm.12がリリース。 CVE-2026-46595（CVSS 10.0 Critical）を含む30件超のCVEを修正。 Proxy・Control Plane・Distroless・CNIコンポーネントに影響。 1.28.10-asm.4・1.27.9-asm.15も同時リリース。 Envoy v1.35.13使用。 利用者は速やかにアップグレードを。 https://cloud.google.com/service-mesh/docs/release-notes

    Post summary

    The note announces a new Cloud Service Mesh release fixing over 30 CVEs, including a critical one, urging users to upgrade.

    0000082
    645 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 Critical - Go http://golang.org/x/crypto SSH Auth Bypass (CVE-2026-46595) An incomplete fix for CVE-2024-45337 leaves SSH server configurations vulnerable to authorization bypass — when any callback other than a public key handler is passed, source-address validation is silently skipped in NewServerConn, allowing an attacker to bypass source IP restrictions and gain unauthorized access (CVSS 10.0). 👉 Affected: http://golang.org/x/crypto/ssh < v0.52.0 | Upgrade to v0.52.0

    Post summary

    CVE-2026-46595 is an SSH authorization bypass in Go's crypto package with a CVSS 10.0 score, and a fix is available in version 0.52.0.

    00000102
    196 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgolangcrypto-go-

Explore more

Back to dashboardgolang CVEscrypto vulnerabilities