I think there may be a problem in go.mod around line 1.
The project pins golang.org/x/crypto at v0.54.0, which contains CVE-2026-56854. The vulnerability allows authentication callbacks (PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, GSSAPIWithMICConfig.AllowLogin) to bypass source‑address restrictions, potentially letting unauthorized clients authenticate from unintended IPs. This can lead to privilege escalation or unauthorized access, therefore it is classified as CRITICAL. Upgrading to v0.55.0, where the missing address checks are enforced for all authentication callbacks, eliminates the issue.
Something like this might fix it:
```diff
--- a/go.mod
+++ b/go.mod
@@
-require golang.org/x/crypto v0.54.0
+require golang.org/x/crypto v0.55.0
```
For reference: rule CVE-2026-56854. Rated critical.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
go.modaround line 1.The project pins golang.org/x/crypto at v0.54.0, which contains CVE-2026-56854. The vulnerability allows authentication callbacks (PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, GSSAPIWithMICConfig.AllowLogin) to bypass source‑address restrictions, potentially letting unauthorized clients authenticate from unintended IPs. This can lead to privilege escalation or unauthorized access, therefore it is classified as CRITICAL. Upgrading to v0.55.0, where the missing address checks are enforced for all authentication callbacks, eliminates the issue.
Something like this might fix it:
For reference: rule
CVE-2026-56854. Rated critical.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.