PT-2026-42707 · Go+1 · Golang.Org/X/Crypto+1

Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-39828

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists where an SSH server authentication callback returning PartialSuccessError with non-nil Permissions caused those permissions to be silently discarded. This could lead to the removal of certificate restrictions, such as force-command, following the successful completion of a second factor authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-39828

GO-2026-5014

Affected Products

Golang.Org/X/Crypto

Golang.Org/X/Crypto/Ssh

References · 6

• https://osv.dev/vulnerability/GO-2026-5014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39828 · Security Note
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI · Note
• https://go.dev/issue/79562 · Note
• https://pkg.go.dev/vuln/GO-2026-5014 · Note
• https://go.dev/cl/781621 · Note