What is GHSA-gjhq-gjfw-99mq?

GHSA-gjhq-gjfw-99mq is a security advisory published by GitHub Security Advisories with High severity. The source-address critical option in the Permissions returned by an authentication callback was...

Which CVE IDs does GHSA-gjhq-gjfw-99mq cover?

GHSA-gjhq-gjfw-99mq covers the following CVE IDs: CVE-2026-56854. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gjhq-gjfw-99mq?

GHSA-gjhq-gjfw-99mq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-gjhq-gjfw-99mqHighCVSS 7.5

The source-address critical option in the Permissions returned by an authentication callback was...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-56854 →

📋 Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-56854
https://go.dev/cl/797040
https://go.dev/issue/80213
https://pkg.go.dev/vuln/GO-2026-6303
https://github.com/advisories/GHSA-gjhq-gjfw-99mq