CVE-2026-40884: goshs has an empty-username SFTP password authentication bypass

April 14, 2026 (updated April 27, 2026)

goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release v2.0.0-beta.5.

References

github.com/advisories/GHSA-c29w-qq4m-2gcv
github.com/patrickhener/goshs
github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv
nvd.nist.gov/vuln/detail/CVE-2026-40884

Code Behaviors & Features

Detect and mitigate CVE-2026-40884 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →