Read the docs
TI-2026-28713 Aliases CVE-2026-39831GHSA-89gr-r52h-f8rx

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

Priority MEDIUM 48CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 45 fixed, 25 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh (golang.org/x/crypto): 0.52.0golang.org/x/crypto (Go): 0.52.0Red Hat: 57 advisoriesRed Hat: 45 fixed, 25 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygolang.org/x/crypto/sshbefore 0.52.00.52.0Patch availableCNA
—golang.org/x/crypto (Go)before 0.52.00.52.0Patch availableGHSA-89gr-r52h-f8rx
  • golang.org/x/crypto/ssh VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
  • golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-89gr-r52h-f8rx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*before 0.52.0VulnerableGo standard library
  • cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* Versions before 0.52.0 Vulnerable ·Go standard library

Remediation

  • Fix · CNA golang.org/x/crypto/ssh (golang.org/x/crypto) Fixed in 0.52.0
  • Fix · GHSA-89gr-r52h-f8rx golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →

Red Hat 57 advisories

  • RHSA-2026:90274 Released 2026-10-27 · Red Hat rating Important
    OpenShift Container Platform 4.12.102 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:82785 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.14.76 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-baremetal-rhel8-operator +9
  • RHSA-2026:82813 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.15.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kube-metrics-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9 +23
Show 54 more Red Hat advisories
  • RHSA-2026:79039 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +18
  • RHSA-2026:77552 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.17.59 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +12
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:73853 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.16.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +17
  • RHSA-2026:74434 Released 2026-10-07 · Red Hat rating Important
    OpenShift Container Platform 4.19.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +7
  • RHSA-2026:76752 Released 2026-10-06 · Red Hat rating Important
    OpenShift Security Profiles Operator bug fix and enhancement update
    • OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:71450 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.20.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:71453 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.21.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:72848 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.7 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/azure-service-operator-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +7
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:68541 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.20.39 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator, registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9 +10
  • RHSA-2026:68334 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:66352 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.21.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:67450 Released 2026-09-14 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-22.el9_6.5, podman-docker-5:5.4.0-22.el9_6.5, podman-plugins-5:5.4.0-22.el9_6.5 +2
  • RHSA-2026:66521 Released 2026-09-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.1
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.14 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.10 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
  • RHSA-2026:59467 Released 2026-08-25 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
  • RHSA-2026:57801 Released 2026-08-25 · Red Hat rating Important
    OpenShift Container Platform 4.21.30 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:54770 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.22.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-image-registry-rhel9-operator +11
  • RHSA-2026:54432 Released 2026-08-12 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.5 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +1
  • RHSA-2026:54400 Released 2026-08-12 · Red Hat rating Important
    VolSync v0.15 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/volsync-rhel9
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:52910 Released 2026-08-10 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.6 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:52857 Released 2026-08-10 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.19.6 security update
    • Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator
  • RHSA-2026:51079 Released 2026-08-06 · Red Hat rating Important
    RHTAS 1.0.2 - GA Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/policy-controller-rhel9
  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:50911 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Tech Preview Release Of the Model Validation Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-validation-rhel9-operator
  • RHSA-2026:50910 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Tech Preview Release Of the Go based Model Transparency CLI
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-cli-rhel9
  • RHSA-2026:50873 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +2
  • RHSA-2026:50871 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/ctlog-monitor-rhel9, registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:50869 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9
  • RHSA-2026:43692 Released 2026-07-22 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:41031 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.10.24
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40974 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:40972 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:40969 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:40262 Released 2026-07-15 · Red Hat rating Important
    Red Hat Quay 3.9.24
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:36625 Released 2026-07-08 · Red Hat rating Important
    RHACS 4.10.5 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:36319 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.9.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    golang.org/x/crypto/ssh 0.52.0

    9 records Highest priority Priority MEDIUM 4 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshPriority MEDIUM 50
    • TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshPriority MEDIUM 46
    • TI-2026-28712 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshPriority MEDIUM 46
    Show all 9 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Builds for Red Hat OpenShiftAffectedNo fix yet
Confidential Compute AttestationAffectedNo fix planned: Will not fix
External Secrets Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift for Windows ContainersAffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Zero Trust Workload Identity ManagerAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322
Cluster Observability Operator 1.5Fixed RHSA-2026:61314
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:66521
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift API for Data Protection 1.4Fixed RHSA-2026:59467
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
OpenShift API for Data Protection 1.6Fixed RHSA-2026:43692
OpenShift Security Profiles Operator 1Fixed RHSA-2026:76752
RHEM 1.1 for RHEL 10Fixed RHSA-2026:68334
RHEM 1.1 for RHEL 9Fixed RHSA-2026:68334
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:54400
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:36319
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:36625
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:67450
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:90274
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:82785
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:82813
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:73853
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:77552
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:79039
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:74434
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:68541, RHSA-2026:71450
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:57801, RHSA-2026:66352, RHSA-2026:71453
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:54770
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift GitOps 1.19Fixed RHSA-2026:52857
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:52910
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Red Hat Quay 3.10Fixed RHSA-2026:41031
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:40262
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:40969, RHSA-2026:40972, RHSA-2026:40974
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:50869, RHSA-2026:50871, RHSA-2026:50873, RHSA-2026:50910, RHSA-2026:50911, RHSA-2026:51079
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:54432
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194, RHSA-2026:72848
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:59579
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:59558
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 58 products
  • Cluster Observability Operator 1.5
  • Cryostat 4
  • ExternalDNS Operator
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • OpenShift API for Data Protection 1.3
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift API for Data Protection 1.6
  • OpenShift Security Profiles Operator 1
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.19
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift for Windows Containers
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Quay 3.10
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39831
  2. 2026-10-03 Alias added: GHSA-89gr-r52h-f8rx
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
  5. 2026-10-07 Fix available: RHSA-2026:74434 · Red Hat
  6. 2026-10-07 Fix available: OpenShift Security Profiles Operator 1, Red Hat OpenShift Container Platform 4.19 · Red Hat
  7. 2026-10-09 Fix available: RHSA-2026:73853 · Red Hat
  8. 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.16 · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  11. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
  12. 2026-10-16 Fix available: RHSA-2026:77552 · Red Hat
  13. 2026-10-16 Fix available: RHSA-2026:79039 · Red Hat
  14. 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:82813 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:82785 · Red Hat
  17. 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 · Red Hat
  18. 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.12 · Red Hat
  19. 2026-10-30 Fix available: RHSA-2026:90274 · Red Hat
  20. 2026-10-30 Affected versions changed · Red Hat
  21. 2026-11-05 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  22. 2026-11-08 Affected versions changed · Red Hat

References

Advisory 2

Other 4

  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-30791 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVSS 3.1CRITICAL 9.1
  • TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 10.0
  • TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
  • TI-2026-28714 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
  • TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences