CVE-2026-40884: goshs: Empty-username SFTP password authentication bypass in goshs

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-21 · updated 2026-10-26
Weakness: CWE-306

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

Affected products

patrickhener goshs: before 2.0.0; 2.0.0-beta1, 2.0.0-beta2, 2.0.0-beta3, 2.0.0-beta4, 2.0.0-beta5 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: patrickhener goshs 2.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-40884 or the next vulnerability affects your stack