CVE-2026-46595: Golang.org/x/crypto Remote Code Execution Vulnerability

Q: What is CVE-2026-46595?

CVE-2026-46595 is a security vulnerability in Golang.org/x/crypto involving Invoking VerifiedPublicKeyCallback permissions skip enforcement under CWE-303: Incorrect Implementation of Authentication Algorithm.

Q: Which Golang.org/x/crypto versions are affected?

Affected versions include releases prior to 0.52.0 across affected packages: golang.org/x/crypto.

Q: What version fixes CVE-2026-46595?

Upgrading to 0.52.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is golang.org/x/crypto affected?

Yes, golang.org/x/crypto is affected in releases prior to 0.52.0. Upgrade your dependency to 0.52.0 or later.

Q: What is the CVSS score of CVE-2026-46595?

CVE-2026-46595 has a CVSS v3.1 base score of 10.0 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

Q: What CWE is associated with CVE-2026-46595?

CVE-2026-46595 is classified under CWE-303: Incorrect Implementation of Authentication Algorithm (The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.).

Q: How can I check Go dependencies for CVE-2026-46595?

Run the dependency tree command: 'inspect dependencies for golang.org/x/crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-x527-x647-q7gg

CVSS 10.0

CWE-303 CWE-863

Published 2026-06-25

Advisory Summary

CVE-2026-46595 is a CRITICAL (CVSS 10.0) remote code execution vulnerability (CWE-303: Incorrect Implementation of Authentication Algorithm) affecting Golang.org/x/crypto libraries in the Go ecosystem. The issue involves invoking verifiedpublickeycallback permissions skip enforcement. Remediation is available by upgrading affected packages to version 0.52.0.

CVE-2026-46595 at a Glance

CVE Identifier CVE-2026-46595

GHSA Identifier GHSA-x527-x647-q7gg

Severity CRITICAL

CVSS v3.1 Base Score 10.0

CWE Classification CWE-303: Incorrect Implementation of Authentication Algorithm

Affected Product Golang.org/x/crypto

Package Ecosystem Go

Published Date 2026-06-25

Last Updated 2026-07-17

Security Impact

CVSS: 10.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Changed (S:C)

Confidentiality High (C:H)

Integrity High (I:H)

Availability Low (A:L)

How to Fix CVE-2026-46595

To remediate this vulnerability, upgrade all affected Golang.org/x/crypto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

golang.org/x/crypto fixed: 0.52.0

Upgrade golang.org/x/crypto to 0.52.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for golang.org/x/crypto

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-46595, inspect your project dependencies for Golang.org/x/crypto:

inspect dependencies for golang.org/x/crypto

Analyze the terminal output to locate any version of Golang.org/x/crypto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.52.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-303: Incorrect Implementation of Authentication Algorithm, where the requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. In Golang.org/x/crypto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

CVE-2026-46595 Affected Golang.org/x/crypto Versions

1 component(s)

Fixed Versions:

0.52.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
golang.org/x/crypto golang/golang.org/x/crypto	Go	< 0.52.0	0.52.0

References

NVD — CVE-2026-46595 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-46595

NVD — CVE-2026-46595 NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-45337

Golang.org/x/crypto Security Information SECURITY

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json

pkg.go.dev/vuln/go-2026-5023 WEB

https://pkg.go.dev/vuln/GO-2026-5023

groups.google.com/g/golang-announce/c... WEB

https://groups.google.com/g/golang-announce/c/a082jnz-LvI

go.dev/issue/79570 WEB

https://go.dev/issue/79570

go.dev/cl/781642 WEB

https://go.dev/cl/781642

cs.opensource.google/go/x/crypto PACKAGE

https://cs.opensource.google/go/x/crypto

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2480689

Golang.org/x/crypto Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2026-46595

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41036

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41019

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40945

access.redhat.com/errata/rhsa-2026:40... WEB

https://access.redhat.com/errata/RHSA-2026:40118

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37387

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37275

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36820

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36808

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36797

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36796

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36651

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36648

access.redhat.com/errata/rhsa-2026:36... WEB

https://access.redhat.com/errata/RHSA-2026:36207

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:33531

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:33524

access.redhat.com/errata/rhsa-2026:30... WEB

https://access.redhat.com/errata/RHSA-2026:30651

access.redhat.com/errata/rhsa-2026:30... WEB

https://access.redhat.com/errata/RHSA-2026:30650

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26547

access.redhat.com/errata/rhsa-2026:26... WEB

https://access.redhat.com/errata/RHSA-2026:26546

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:23264

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:23262

Frequently Asked Questions

What is CVE-2026-46595?

CVE-2026-46595 is a security vulnerability in Golang.org/x/crypto involving Invoking VerifiedPublicKeyCallback permissions skip enforcement under CWE-303: Incorrect Implementation of Authentication Algorithm.

Which Golang.org/x/crypto versions are affected?

Affected versions include releases prior to 0.52.0 across affected packages: golang.org/x/crypto.

What version fixes CVE-2026-46595?

Upgrading to 0.52.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is golang.org/x/crypto affected?

Yes, golang.org/x/crypto is affected in releases prior to 0.52.0. Upgrade your dependency to 0.52.0 or later.

What is the CVSS score of CVE-2026-46595?

CVE-2026-46595 has a CVSS v3.1 base score of 10.0 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.

What CWE is associated with CVE-2026-46595?

CVE-2026-46595 is classified under CWE-303: Incorrect Implementation of Authentication Algorithm (The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.).

How can I check Go dependencies for CVE-2026-46595?

Run the dependency tree command: 'inspect dependencies for golang.org/x/crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x527-x647-q7gg",
  "modified" : "2026-07-17T15:32:15Z",
  "published" : "2026-06-25T22:23:16Z",
  "aliases" : [ "CVE-2026-46595" ],
  "summary" : "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement",
  "details" : "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "golang.org/x/crypto"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.52.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-45337"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2026-5023"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/issue/79570"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/cl/781642"
  }, {
    "type" : "PACKAGE",
    "url" : "https://cs.opensource.google/go/x/crypto"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-46595"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41036"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41019"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40945"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:40118"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37387"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37275"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36820"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36808"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36797"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36796"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36651"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36648"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:36207"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:33531"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:33524"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:30651"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:30650"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26547"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:26546"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:23264"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:23262"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-303", "CWE-863" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-25T22:23:16Z",
    "nvd_published_at" : "2026-05-22T04:16:25Z"
  }
}

CVSS V3

10.0 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Changed (S:C)

Confidentiality High (C:H)

Integrity High (I:H)

Availability Low (A:L)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Advisory Metadata

Source ID: GHSA-x527-x647-q7gg
Schema Version: 1.4.0
Published: 2026-06-25 22:23
Last Modified: 2026-07-17 15:32
Database Record File: advisories/github-reviewed/2026/06/GHSA-x527-x647-q7gg/GHSA-x527-x647-q7gg.json