CVE-2026-62325: goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

July 28, 2026

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

References

github.com/advisories/GHSA-rjrw-mjq6-hpmm
github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a
github.com/goshs-labs/goshs/releases/tag/v2.1.4
github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm
nvd.nist.gov/vuln/detail/CVE-2026-62325

Code Behaviors & Features

Detect and mitigate CVE-2026-62325 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →