CVE-2026-56854 in ssh
Summary
by MITRE • 08/28/2026
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability described involves a critical flaw in how source-address restrictions are enforced within an authentication framework, specifically affecting permissions granted through various authentication callbacks. This issue represents an extension of the fix for CVE-2026-46595 and highlights a significant gap in access control validation mechanisms. The core problem lies in the inconsistent application of security policies across different authentication methods. While certain callback paths such as PublicKeyCallback and VerifiedPublicKeyCallback correctly validated permissions against the client's remote address, other critical pathways including PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin failed to perform this validation entirely. As a result, any source-address restriction configured by these callbacks was silently ignored, allowing connections from unauthorized IP addresses that should have been blocked based on the defined security policies.
This inconsistency creates a severe bypass opportunity for attackers who can exploit the weaker authentication paths to gain access despite explicit address-based restrictions being in place elsewhere in the system. The failure to validate permissions against the client's remote address means that an attacker could potentially authenticate using one of the unvalidated callback types and establish a connection from any IP address, effectively neutralizing network-level security controls designed to limit access based on source location. This type of vulnerability is particularly dangerous because it allows for privilege escalation or unauthorized access without triggering typical alerts associated with direct brute-force attempts, as the authentication itself may succeed legitimately but under conditions that violate organizational security policies regarding allowed sources.
From a classification perspective, this flaw aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the source-address restriction was intended to limit access based on predefined trusted networks. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access by allowing adversaries to bypass network-based restrictions that are typically part of a defense-in-depth strategy. The specific technique relates to T1078 Valid Accounts where an attacker uses legitimate credentials but exploits the lack of contextual validation such as source IP verification to gain unauthorized entry into systems or networks that should be protected from their location.
The operational impact of this vulnerability is substantial, particularly in environments where strict network segmentation and zero-trust principles are enforced. Organizations relying on these authentication callbacks for sensitive services may find themselves exposed to attacks originating from untrusted networks because the security controls appear to function correctly during configuration but fail silently at runtime. This can lead to data exfiltration, lateral movement within a network, or complete compromise of systems that were believed to be protected by IP whitelisting or blacklisting rules associated with those specific authentication methods. The silent nature of the failure makes detection difficult without deep packet inspection or comprehensive logging analysis focused on permission validation outcomes rather than just successful login events.
To mitigate this risk, it is essential to ensure that all authentication callbacks uniformly enforce source-address restrictions regardless of the method used for authentication. This requires a code-level fix where every path through the authentication logic validates permissions against the client's remote address before granting access. Security teams should audit their current implementations to identify any custom or third-party callback handlers that might have similar inconsistencies and apply the same rigorous validation checks across all entry points. Additionally, implementing comprehensive logging of permission decisions including source IP verification results can help detect attempts to exploit this gap in real-time. Regular security assessments focusing on access control logic consistency are recommended to prevent such discrepancies from persisting in production environments where they could be leveraged by sophisticated adversaries seeking to bypass network-level defenses.