CVE-2026-46595 is an incorrect authorization vulnerability (CWE-863) in the golang.org/x/crypto/ssh package. The flaw arises because source-address validation is bypassed when any callback other than the public key callback is used in SSH server configurations. This allows an attacker to circumvent intended access controls. The vulnerability was previously partially addressed in CVE-2024-45337 for public key callbacks, but this issue extends to other callback types. The vulnerability has a critical CVSS 3.1 base score of 10. Red Hat advisories mention this CVE in the context of security updates for Red Hat Edge Manager and related products, indicating that fixes have been applied in those distributions.

Successful exploitation of this vulnerability can lead to a complete bypass of authorization controls in the affected SSH server implementations using golang.org/x/crypto/ssh, potentially allowing unauthorized command execution or access. The CVSS score of 10 indicates critical impact with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and low availability impacts.

The vendor advisory does not explicitly state the availability of a patch or remediation level. However, multiple Red Hat security advisories reference this CVE and indicate that fixes have been applied in Red Hat Edge Manager and related products. Users of affected Red Hat products should apply the relevant security updates as per Red Hat advisories. For other users of golang.org/x/crypto/ssh, check the official golang.org/x/crypto repository and vendor advisories for patches or updates addressing this issue. Patch status is not yet confirmed for all users — verify with vendor advisories for current remediation guidance.