Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
Priority MEDIUM 48CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 45 fixed, 14 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00683 52nd percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh/agent (golang.org/x/crypto): 0.52.0golang.org/x/crypto (Go): 0.52.0Red Hat: 52 advisoriesRed Hat: 45 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/crypto/ssh/agent | before 0.52.0 | 0.52.0 | Patch available | CNA |
| — | golang.org/x/crypto (Go) | before 0.52.0 | 0.52.0 | Patch available | GHSA-f5wc-c3c7-36mc |
- golang.org/x/crypto/ssh/agent VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
- golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-f5wc-c3c7-36mc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* | before 0.52.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* Versions before 0.52.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/crypto/ssh/agent (golang.org/x/crypto) Fixed in 0.52.0
- Fix · GHSA-f5wc-c3c7-36mc golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →
Red Hat 52 advisories
- RHSA-2026:90274 Released 2026-10-27 · Red Hat rating ImportantOpenShift Container Platform 4.12.102 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:82785 Released 2026-10-22 · Red Hat rating ImportantOpenShift Container Platform 4.14.76 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-baremetal-rhel8-operator +9
- RHSA-2026:82813 Released 2026-10-22 · Red Hat rating ImportantOpenShift Container Platform 4.15.70 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kube-metrics-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9 +23
Show 49 more Red Hat advisories
- RHSA-2026:79039 Released 2026-10-15 · Red Hat rating ImportantOpenShift Container Platform 4.18.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +18
- RHSA-2026:77552 Released 2026-10-15 · Red Hat rating ImportantOpenShift Container Platform 4.17.59 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +12
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:73853 Released 2026-10-08 · Red Hat rating ImportantOpenShift Container Platform 4.16.72 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +17
- RHSA-2026:74434 Released 2026-10-07 · Red Hat rating ImportantOpenShift Container Platform 4.19.50 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +7
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:71450 Released 2026-09-29 · Red Hat rating ImportantOpenShift Container Platform 4.20.40 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:71453 Released 2026-09-29 · Red Hat rating ImportantOpenShift Container Platform 4.21.35 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:70870 Released 2026-09-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.5.3
- Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:67450 Released 2026-09-14 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-22.el9_6.5, podman-docker-5:5.4.0-22.el9_6.5, podman-plugins-5:5.4.0-22.el9_6.5 +2
- RHSA-2026:66521 Released 2026-09-10 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.6.1
- Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
- RHSA-2026:61314 Released 2026-08-31 · Red Hat rating ImportantCluster Observability Operator 1.5.2
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
- RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.6.14 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
- RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.5 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:52910 Released 2026-08-10 · Red Hat rating ImportantRed Hat OpenShift GitOps v1.20.6 security update
- Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
- RHSA-2026:52857 Released 2026-08-10 · Red Hat rating ImportantRed Hat OpenShift GitOps v1.19.6 security update
- Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator
- RHSA-2026:50888 Released 2026-08-05 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:49944 Released 2026-08-04 · Red Hat rating Importantcontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.8-1.module+el8.8.0+24545+b713e821.src::container-tools:rhel8 +47
- RHSA-2026:49767 Released 2026-08-03 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48771 Released 2026-07-30 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:43692 Released 2026-07-22 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
- RHSA-2026:43052 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42146 Released 2026-07-20 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:41036 Released 2026-07-16 · Red Hat rating ImportantRed Hat OpenShift Builds 1.8.1
- Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
- RHSA-2026:41031 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.10.24
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41019 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
- RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
- RHSA-2026:40972 Released 2026-07-16 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:37410 Released 2026-07-09 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.43.1-3.el9_8, buildah-tests-2:1.43.1-3.el9_8
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:37276 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:37271 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:37123 Released 2026-07-09 · Red Hat rating Importantpodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.8.2-4.el9_8, podman-docker-6:5.8.2-4.el9_8, podman-plugins-6:5.8.2-4.el9_8 +2
- RHSA-2026:37072 Released 2026-07-09 · Red Hat rating Importantpodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.8.2-4.el10_2, podman-docker-7:5.8.2-4.el10_2, podman-remote-7:5.8.2-4.el10_2
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.8.2-4.el10_2
- RHSA-2026:36796 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
- RHSA-2026:36797 Released 2026-07-08 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:36648 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Builds 1.7.4
- Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
- RHSA-2026:36625 Released 2026-07-08 · Red Hat rating ImportantRHACS 4.10.5 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
- RHSA-2026:36319 Released 2026-07-07 · Red Hat rating ImportantRHACS 4.9.9 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
- RHSA-2026:36199 Released 2026-07-07 · Red Hat rating Importantbuildah security update
- Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.43.1-3.el10_2, buildah-tests-2:1.43.1-3.el10_2
- RHSA-2026:35833 Released 2026-07-06 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.s390x::container-tools:rhel8 +47
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
golang.org/x/crypto/ssh/agent 0.52.0
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentPriority MEDIUM 48
- TI-2026-34257 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agentPriority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet |
| External Secrets Operator for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Workspaces Operator | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322 |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:61314 |
| Logging Subsystem for Red Hat OpenShift 6.5 | Fixed | RHSA-2026:70870 |
| Logging Subsystem for Red Hat OpenShift 6.6 | Fixed | RHSA-2026:66521 |
| OpenShift API for Data Protection 1.6 | Fixed | RHSA-2026:43692 |
| RHEM 1.0 for RHEL 9 | Fixed | RHSA-2026:36796 |
| RHEM 1.1 for RHEL 10 | Fixed | RHSA-2026:41019 |
| RHEM 1.1 for RHEL 9 | Fixed | RHSA-2026:41019 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:36319 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:36625 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:36199, RHSA-2026:37072 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:35833 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:37123, RHSA-2026:37410 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:49944 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:67450 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:49944 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:37072 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift Builds 1.7.3 | Fixed | RHSA-2026:36648 |
| Red Hat OpenShift Builds 1.8.3 | Fixed | RHSA-2026:41036 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:90274 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:82785 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:82813 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:73853 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:77552 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:79039 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:74434 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:71450 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:71453 |
| Red Hat OpenShift GitOps 1.19 | Fixed | RHSA-2026:52857 |
| Red Hat OpenShift GitOps 1.20 | Fixed | RHSA-2026:52910 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:41031 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:42146, RHSA-2026:43052 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:40972 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:36797, RHSA-2026:37271, RHSA-2026:48771 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:57194 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:59579 |
Not affected: 45 products
- Cluster Observability Operator 1.5
- ExternalDNS Operator
- Logging Subsystem for Red Hat OpenShift 6.5
- Logging Subsystem for Red Hat OpenShift 6.6
- OpenShift API for Data Protection 1.6
- RHEM 1.0 for RHEL 9
- RHEM 1.1 for RHEL 10
- RHEM 1.1 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Builds 1.7.3
- Red Hat OpenShift Builds 1.8.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift GitOps
- Red Hat OpenShift GitOps 1.19
- Red Hat OpenShift GitOps 1.20
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Data Foundation 4.22
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Artifact Signer 1.4
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-39832
- 2026-10-03 Alias added: GHSA-f5wc-c3c7-36mc
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-07 Fix available: RHSA-2026:74434 · Red Hat
- 2026-10-07 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:73853 · Red Hat
- 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.16 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:77552 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:79039 · Red Hat
- 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:82813 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:82785 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 · Red Hat
- 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.12 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90274 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
- 2026-11-07 Affected versions changed · Red Hat
- 2026-11-08 Affected versions changed · Red Hat
References
Other 37
- https://go.dev/issue/79435
- https://go.dev/cl/778640
- https://go.dev/cl/778641
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://access.redhat.com/errata/RHSA-2026:35833
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:49944
- https://access.redhat.com/errata/RHSA-2026:52857
- https://access.redhat.com/errata/RHSA-2026:52910
- https://access.redhat.com/security/cve/CVE-2026-39832
- https://bugzilla.redhat.com/show_bug.cgi?id=2480685
- https://cs.opensource.google/go/x/crypto
- https://go.dev/cl/778642
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json
- https://access.redhat.com/errata/RHSA-2026:36199
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:37072
- https://access.redhat.com/errata/RHSA-2026:37123
- https://access.redhat.com/errata/RHSA-2026:37271
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:37410
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40972
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:41031
More Go standard library Crypto vulnerabilities
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2026-30791 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVSS 3.1CRITICAL 9.1
- TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 10.0
- TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
- TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-39832 · CVE Program
- CVE-2026-39832 · NVD
- FIRST EPSS
- GHSA-f5wc-c3c7-36mc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-39832 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences