CVE-2026-40884

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40884", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T15:57:41.719Z", "datePublished": "2026-04-21T19:39:25.698Z", "dateUpdated": "2026-04-22T13:44:15.524Z"}, "containers": {"cna": {"title": "goshs: Empty-username SFTP password authentication bypass in goshs", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"}], "affected": [{"vendor": "patrickhener", "product": "goshs", "versions": [{"version": "< 2.0.0-beta.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T19:39:25.698Z"}, "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6."}], "source": {"advisory": "GHSA-c29w-qq4m-2gcv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:43:56.178845Z", "id": "CVE-2026-40884", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:44:15.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40884", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T13:43:56.178845Z"}}}], "references": [{"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:44:10.401Z"}}], "cna": {"title": "goshs: Empty-username SFTP password authentication bypass in goshs", "source": {"advisory": "GHSA-c29w-qq4m-2gcv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "patrickhener", "product": "goshs", "versions": [{"status": "affected", "version": "< 2.0.0-beta.6"}]}], "references": [{"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv", "name": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T19:39:25.698Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40884", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:44:15.524Z", "dateReserved": "2026-04-15T15:57:41.719Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T19:39:25.698Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "goshs", "vendor": "patrickhener", "versions": [{"status": "affected", "version": "< 2.0.0-beta.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*", "matchCriteriaId": "471EA45E-3052-469D-B301-4D92FB187228", "versionEndExcluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*", "matchCriteriaId": "047ECFC3-056F-4FAC-9B64-5F7C120CFFE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*", "matchCriteriaId": "6EA86AD2-EE6D-4427-9434-A9A49A4D38F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*", "matchCriteriaId": "F44CF6A3-C1BC-4636-A1D5-1ED69A340FE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*", "matchCriteriaId": "486D1F77-023B-4EB9-8B49-17EF6546F2DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*", "matchCriteriaId": "5834E73F-2EF9-42BD-BE8B-DE087A19A132", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6."}, {"lang": "es", "value": "goshs es un SimpleHTTPServer escrito en Go. Anteriormente a la versi\u00f3n 2.0.0-beta.6, goshs contiene una omisi\u00f3n de autenticaci\u00f3n SFTP cuando se utiliza la sintaxis de autenticaci\u00f3n b\u00e1sica de nombre de usuario vac\u00edo documentada. Si el servidor se inicia con -b \u2019:pass\u2019 junto con -sftp, goshs acepta esa configuraci\u00f3n pero no instala ning\u00fan gestor de contrase\u00f1as SFTP. Como resultado, un atacante de red no autenticado puede conectarse al servicio SFTP y acceder a archivos sin una contrase\u00f1a. Esta vulnerabilidad se corrige en la versi\u00f3n 2.0.0-beta.6."}], "id": "CVE-2026-40884", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40884", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:43:56.178845Z", "version": "2.0.3"}}]}, "published": "2026-04-21T20:17:02.107", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0-beta.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "goshs", "source": "cna", "vendor": "patrickhener"}, "product": "goshs", "vendor": "patrickhener"}], "analysis": {"en": {"generated_at": "2026-04-22T06:43:17.177114+00:00", "value": {"mitigation_remediation": ["Upgrade to goshs version 2.0.0\u2011beta.6 or later, which implements proper SFTP authentication handling.", "If upgrading is not immediately possible, disable the SFTP feature or block inbound traffic to the SFTP port from untrusted networks.", "Avoid using the -b ':pass' syntax with an empty username in any configuration until a secure version is deployed."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated SFTP Access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the patrickhener:goshs product in all releases prior to 2.0.0\u2011beta.6. The affected version information is explicitly limited to versions older than 2.0.0\u2011beta.6; no other vendor or product versions are listed.", "description_and_impact": "goshs, a lightweight HTTP and SFTP server written in Go, contains a flaw that allows an attacker to bypass authentication by exploiting the documented empty\u2011username syntax. When the server is launched with the arguments -b ':pass' and -sftp, it accepts the configuration but installs no SFTP password handler, giving an unauthenticated user the ability to open an SFTP session and read or write any files on the server. This constitutes a severe authentication failure (CWE\u2011306) that can lead to the compromise of application data and potentially broader system control.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk, as the vulnerability is readily exploitable over the network. Logically, an attacker can simply open an SFTP connection using the empty username syntax, achieving unauthenticated file access. Given the broad availability of the target and the lack of countermeasures, the likelihood of exploitation is high in environments where the service is exposed to the internet or untrusted networks."}}}}, "created": "2026-04-22T06:45:10.879471+00:00", "updated": "2026-04-22T11:45:26.226964+00:00", "vendors": ["patrickhener", "patrickhener$PRODUCT$goshs"]}