CVE-2026-62325: goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

July 28, 2026

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

References

github.com/advisories/GHSA-rjrw-mjq6-hpmm
github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a
github.com/goshs-labs/goshs/releases/tag/v2.1.4
github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm
nvd.nist.gov/vuln/detail/CVE-2026-62325

Code Behaviors & Features

Detect and mitigate CVE-2026-62325 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →