CVE-2026-56854: 
New Relic Agent vulnerability analysis and mitigation

CVE-2026-56854 is an authentication bypass vulnerability in the golang.org/x/crypto/ssh package that fails to enforce source-address critical option restrictions for several SSH authentication callback methods. The flaw extends an incomplete fix from CVE-2026-46595: while PublicKeyCallback and VerifiedPublicKeyCallback paths were corrected previously, the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks remained unprotected, silently ignoring source-address restrictions. All versions of golang.org/x/crypto/ssh prior to 0.55.0 are affected. It was published on August 28, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-346 (Origin Validation Error) and CWE-863 (Incorrect Authorization). When an SSH server built with golang.org/x/crypto/ssh uses authentication callbacks such as PasswordCallback or KeyboardInteractiveCallback and those callbacks return Permissions containing a source-address critical option, the SSH library failed to validate the connecting client's remote IP address against that restriction. As a result, a client connecting from any IP address could successfully authenticate even if the server's callback logic intended to restrict access to specific source addresses. The fix, applied in version 0.55.0, ensures the source-address check is uniformly applied to Permissions returned by any authentication callback (Red Hat Bugzilla, Go Issue).

Successful exploitation allows an unauthenticated network attacker to bypass source-address-based access controls on SSH services implemented using the affected golang.org/x/crypto/ssh library. The primary impact is a high confidentiality risk — an attacker from a disallowed IP address can gain unauthorized access to SSH sessions and the data or systems accessible through them. Integrity and availability are not directly impacted by this vulnerability, but unauthorized SSH access could serve as a foothold for further lateral movement or data exfiltration (GitHub Advisory, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is automatable (no user interaction required) and requires no privileges, making it straightforward to exploit against any exposed SSH service using the affected library with source-address restrictions configured. The EPSS score is approximately 0.325%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify SSH services built with golang.org/x/crypto/ssh versions prior to 0.55.0 that use PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin for authentication and have source-address restrictions configured.
2. Attempt authentication from a restricted IP: Connect to the target SSH service from an IP address that would normally be blocked by the server's source-address restriction (e.g., using a standard SSH client: ssh user@target-host).
3. Provide valid credentials: Supply valid credentials (password, keyboard-interactive responses, etc.) for an account whose callback-returned Permissions include a source-address critical option.
4. Bypass enforced: Due to the missing validation, the server accepts the connection despite the client's IP not matching the source-address restriction, granting unauthorized SSH access (Red Hat Bugzilla, Go Issue).

• Network: SSH connections successfully established from IP addresses outside the expected/allowed source-address ranges for affected accounts; unexpected geographic or ASN origins in SSH connection logs.
• Logs: SSH server logs showing successful authentication events from IP addresses that should have been blocked by source-address policy; authentication method recorded as password, keyboard-interactive, or none for accounts with source-address restrictions.
• Process/Application: Go-based SSH server applications using golang.org/x/crypto/ssh < 0.55.0 accepting connections without source-address enforcement; audit logs showing access from unauthorized network segments.

Upgrade golang.org/x/crypto/ssh to version 0.55.0 or later, which applies the source-address check uniformly to all authentication callbacks (Go Change, Go Vulnerability DB). As an interim workaround, implement network-level firewall rules or SSH daemon-level IP restrictions (e.g., using AllowUsers with @host syntax in OpenSSH, or network ACLs) to enforce source-address restrictions independently of the application layer. Additionally, review and audit SSH authentication logs for connections from unexpected source IP addresses to detect any prior unauthorized access (Red Hat Advisory).