x/crypto/ssh: source-address restriction bypassed in 5 callback families

[thatnealpatel]

This is a follow up to #79570 (CVE-2026-46595)

Excerpt from the original report:

CVE-2026-46595 (#79570, commit 533fb3f) fixed a source-address
enforcement gap in the VerifiedPublicKeyCallback path of [golang.org/x/crypto/ssh](http://golang.org/x/crypto/ssh%60) http://golang.org/x/crypto/ssh. That fix is
correct but partial: checkSourceAddress is called only inside the
publickey branch of the authentication dispatch loop (server.go:682),
which covers PublicKeyCallback and VerifiedPublicKeyCallback. Five
other callback families that can return
Permissions.CriticalOptions["source-address"] are not covered by the fix
and remain vulnerable at HEAD commit 9beb694 (2026-05-25).

Thanks to Longwei Wang (@gn00295120) for reporting this issue.

This is CVE-2026-56854.

---

This is a de-facto PUBLIC track issue originally tracked in http://b/517101534.

[gopherbot]

Change https://go.dev/cl/797040 mentions this issue: ssh: enforce the source-address critical option for all auth callbacks