The golang.org/x/crypto/ssh package contains a critical authorization flaw that allows attackers to bypass source-address restrictions, potentially leading to unauthorized system access.

This vulnerability is an incorrect authorization issue (CWE-863) where the ssh library fails to validate source-address restrictions for PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin. This flaw allows an unauthenticated remote attacker to ignore configured IP-based access controls during the SSH authentication process.

Successful exploitation of this vulnerability permits unauthorized access to systems that rely on source-address restrictions for perimeter security. Given the CVSS score of 7.5, this high-severity flaw could lead to significant data compromise if SSH services are exposed to the internet with the expectation that IP-based filtering is enforcing access policies.

Immediate Action: Update the golang.org/x/crypto package to version 0.55.0 or later to ensure all authentication callbacks correctly enforce source-address restrictions.

Proactive Monitoring: Monitor SSH authentication logs for successful logins originating from unexpected or unauthorized network segments that should have been blocked by source-address restrictions.

Compensating Controls: Implement network-level access control lists or firewall rules to restrict access to SSH services to known, trusted IP addresses until the library can be updated.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant failure in access control logic that undermines network-based security policies. Organizations using the golang.org/x/crypto/ssh package must prioritize updating to version 0.55.0 immediately to restore the integrity of their authentication workflows and prevent potential unauthorized access.