CVE-2026-56854
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Risk Assessment
The risk is that source-address restrictions set by certain authentication methods may be ignored, allowing unauthorized clients to connect from unexpected IP addresses.
Recommendation
Update to a version that includes the fix enforcing source-address checks for all authentication callbacks.
Other vulnerabilities in SSH
See all- CVE-2026-39828Medium
In SSH, when an authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded. This could drop certificate restrictions like force-command after a second factor. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
- CVE-2000-0217Medium
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.
- CVE-1999-1231Medium
ssh version 2.0.12, and possibly other versions, allows valid usernames to attempt to enter the correct password multiple times, but only prompts for a password once for an invalid username. This allows remote attackers to determine user account names on the server.
- CVE-1999-1159Medium
SSH version 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root.
Original NVD description (English source)
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.