Medium [CVE-2026-56854] Authentication bypass due to unenforced source-address restrictions

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.

AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks.

In applications that misuse the ServerConfig. PublicKeyCallback callback to make security relevant authorization decisions, an attacker with a valid key could bypass network-based access controls to gain additional privileges.

This vulnerability severity is Important due to the requirement that an attacker already have a valid private key. Red Hat severity: Important — CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

Weakness: CWE-346.