SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-56854

HIGH · CVSS 7.5 EPSS 0.33%

Source: NVD + CISA KEV + EPSS · Published 2026-08-28 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability arises from insufficient enforcement of source-address restrictions in several authentication callbacks, including PasswordCallback and KeyboardInteractiveCallback, allowing unauthorized access based on client remote addresses. This oversight could lead to unauthorized users bypassing security measures, potentially compromising sensitive systems. Organizations utilizing these authentication methods should prioritize remediation to mitigate the risk of unauthorized access.

CVE
CVE-2026-56854
Severity
HIGH
CVSS
7.5
EPSS
0.33%

Original NVD Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.