CVE-2026-39828: Golang Crypto

Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Affected products

• Golang Crypto: before 0.52.0 (fixed in 0.52.0)

Published 2026-05-22. Last modified 2026-09-11.