CVE-2026-46595 is an incorrect authorization vulnerability (CWE-863, CWE-303) in golang.org/x/crypto/ssh. When SSH servers use authentication callbacks other than public key, source-address validation can be skipped, allowing an attacker who authenticates through such a callback to bypass intended source-address restrictions. This vulnerability is a follow-up to CVE-2024-45337, which addressed an incomplete fix for similar authorization bypass issues. The vulnerability affects services built with the vulnerable x/crypto/ssh package, including Red Hat Enterprise Linux golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components embedding Go SSH servers with mixed callback types. Red Hat has issued advisories and recommends upgrading to fixed versions of golang.org/x/crypto/ssh and ensuring SSH servers use supported public-key callback configurations with source-address validation. The CVSS v3.1 base score is 10.0 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, changed scope, and high confidentiality and integrity impact with low availability impact.

An attacker with low privileges who can authenticate via a non-public-key callback can bypass source-address restrictions intended to limit SSH access, potentially gaining unauthorized access to SSH servers. This compromises confidentiality and integrity of affected systems. The vulnerability affects any SSH server configuration relying on source-address validation combined with non-public-key authentication callbacks. Red Hat products embedding the vulnerable package, such as RHEL, OpenShift, and Ceph components, are impacted. There are no known exploits in the wild at this time.

A fix is available. Users should upgrade to a fixed release of golang.org/x/crypto/ssh by updating golang or rebuilding affected packages. Additionally, SSH servers should be configured to use supported public-key callback configurations with source-address validation as intended to prevent bypass. Follow vendor advisories and apply updates promptly.