CVE-2026-39828 - When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. - 漏洞详情

漏洞编号：CVE-2026-39828

风险等级：中危

漏洞来源：CVE

CVE 编号：CVE-2026-39828

CNNVD 编号：-

厂商/产品：golang / crypto

影响范围：cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

CWE：CWE-295

发布/更新时间：2026-05-22 / 2026-08-28

漏洞描述

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

漏洞描述

相关链接

相关漏洞