CVE-2026-46598 is a vulnerability in the Go standard library package golang.org/x/crypto/ssh/agent, where supplying malformed or pathological inputs can cause a client application to panic and crash. This affects any service or tooling built with this SSH agent library, including Azure-hosted workloads that rely on Go-based SSH clients. The practical risk is denial of service, where an attacker able to send crafted SSH agent messages can bring down affected processes.

Architect’s Take: Audit your Azure workloads and internal tooling for any Go applications using golang.org/x/crypto/ssh/agent and update the dependency to a patched version immediately; pay particular attention to internet-facing SSH automation, CI/CD pipelines, and bastion host tooling where untrusted input could reach the SSH agent.

Original advisory: CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent