CVE-2026-56854
Public on 2026-08-28
Modified on 2026-08-28
Description
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | amazon-ssm-agent | Not Affected | ||
| Amazon Linux 2023 | amazon-ssm-agent | Not Affected | ||
| Amazon Linux 2023 | buildah | Not Affected | ||
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | docker | Not Affected | ||
| Amazon Linux 2 - Docker Extra | docker | Not Affected | ||
| Amazon Linux 2 - Ecs Extra | docker | Not Affected | ||
| Amazon Linux 2023 | docker | Not Affected | ||
| Amazon Linux 2023 | git-lfs | Not Affected | ||
| Amazon Linux 2 - Core | golang | Not Affected | ||
| Amazon Linux 2023 | golang | Not Affected | ||
| Amazon Linux 2 - Core | rclone | Pending Fix | ||
| Amazon Linux 2023 | rclone | Pending Fix | ||
| Amazon Linux 2 - Docker Extra | runfinch-finch | Not Affected | ||
| Amazon Linux 2023 | runfinch-finch | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |