CVE-2026-40884

OVERVIEW CVE-2026-40884 is an authentication bypass vulnerability in goshs, a SimpleHTTPServer implementation written in Go, affecting versions prior to 2.0.0-beta.6. The flaw exists in the SFTP authentication mechanism when the server is configured with the documented empty-username basic authentication syntax (-b ':pass'). In this configuration, goshs fails to properly install an SFTP password handler, allowing unauthenticated attackers to establish SFTP connections and access files without credentials. SEVERITY This vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL, with an attack vector that is network-based, requires low attack complexity, and demands no privileges or user interaction. The impact is severe across all security dimensions: confidentiality, integrity, and availability are all highly compromised. An unauthenticated remote attacker can freely connect to the SFTP service and read, modify, or delete files on the affected system. EXPLOITATION STATUS CVE-2026-40884 is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and is marked inactive on the Hot List, indicating no widespread active exploitation at this time. The EPSS score of 0.00055 suggests low probability of exploitation in the wild. However, the critical severity rating and straightforward exploitation requirements warrant prompt patching, particularly for internet-facing deployments of goshs running vulnerable versions.