Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-56854, is a bypass of the source-address restriction in the golang.org/x/crypto/ssh package. The source-address critical option in the Permissions object is intended to restrict access to a connection from a specific set of IP addresses. The analysis of the patch reveals that this check was only performed for the publickey authentication method, while being ignored for others like password, keyboard-interactive, none, and gssapi-with-mic.
The patch addresses this by introducing a new function, checkSourceAddressCriticalOption, and moving the check to a centralized location at the end of the main authentication loop (userAuthLoop) within the serverAuthenticate function in ssh/server.go. This ensures that the source-address restriction is enforced for all authentication methods that return a Permissions object.
The primary vulnerable function is the unexported (connection).serverAuthenticate function, which contains the flawed authentication logic. The exported function NewServerConn is the entry point for creating a new server connection and is the symbol listed in the official Go vulnerability database for this CVE. Therefore, both functions are included in the analysis. The patch and the vulnerability description clearly indicate that the vulnerability is the absence of a security check, which is now added.
NewServerConnssh/server.go
(connection).serverAuthenticatessh/server.go