Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Priority MEDIUM 57CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 48 fixed, 12 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0691 94th percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh/knownhosts (golang.org/x/crypto): 0.52.0golang.org/x/crypto (Go): 0.52.0Red Hat: 53 advisoriesRed Hat: 48 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/crypto/ssh/knownhosts | before 0.52.0 | 0.52.0 | Patch available | CNA |
| — | golang.org/x/crypto (Go) | before 0.52.0 | 0.52.0 | Patch available | GHSA-5cgq-3rg8-m6cv |
- golang.org/x/crypto/ssh/knownhosts VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
- golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-5cgq-3rg8-m6cv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* | before 0.52.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* Versions before 0.52.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/crypto/ssh/knownhosts (golang.org/x/crypto) Fixed in 0.52.0
- Fix · GHSA-5cgq-3rg8-m6cv golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →
Red Hat 53 advisories
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
Show 50 more Red Hat advisories
- RHSA-2026:70870 Released 2026-09-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.5.3
- Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:67450 Released 2026-09-14 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-22.el9_6.5, podman-docker-5:5.4.0-22.el9_6.5, podman-plugins-5:5.4.0-22.el9_6.5 +2
- RHSA-2026:66521 Released 2026-09-10 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.6.1
- Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
- RHSA-2026:66022 Released 2026-09-09 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:61314 Released 2026-08-31 · Red Hat rating ImportantCluster Observability Operator 1.5.2
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:59467 Released 2026-08-25 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
- RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.5 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
- RHSA-2026:54400 Released 2026-08-12 · Red Hat rating ImportantVolSync v0.15 security fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/volsync-rhel9
- RHSA-2026:54395 Released 2026-08-12 · Red Hat rating ImportantRed Hat Quay 3.17.4
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:52910 Released 2026-08-10 · Red Hat rating ImportantRed Hat OpenShift GitOps v1.20.6 security update
- Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
- RHSA-2026:52857 Released 2026-08-10 · Red Hat rating ImportantRed Hat OpenShift GitOps v1.19.6 security update
- Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator
- RHSA-2026:51288 Released 2026-08-06 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3.src::container-tools:rhel8, buildah-1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3.x86_64::container-tools:rhel8 +47
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3.src::container-tools:rhel8, buildah-1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3.x86_64::container-tools:rhel8 +47
- RHSA-2026:51033 Released 2026-08-06 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
- RHSA-2026:50888 Released 2026-08-05 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:49944 Released 2026-08-04 · Red Hat rating Importantcontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.8-1.module+el8.8.0+24545+b713e821.src::container-tools:rhel8 +47
- RHSA-2026:49767 Released 2026-08-03 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48771 Released 2026-07-30 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:47737 Released 2026-07-29 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
- RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.8.9 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
- RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:43692 Released 2026-07-22 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
- RHSA-2026:43052 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42146 Released 2026-07-20 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:41064 Released 2026-07-16 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
- RHSA-2026:41036 Released 2026-07-16 · Red Hat rating ImportantRed Hat OpenShift Builds 1.8.1
- Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
- RHSA-2026:41031 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.10.24
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41019 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
- RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:37276 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:37123 Released 2026-07-09 · Red Hat rating Importantpodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.8.2-4.el9_8, podman-docker-6:5.8.2-4.el9_8, podman-plugins-6:5.8.2-4.el9_8 +2
- RHSA-2026:37072 Released 2026-07-09 · Red Hat rating Importantpodman security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.8.2-4.el10_2, podman-docker-7:5.8.2-4.el10_2, podman-remote-7:5.8.2-4.el10_2
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.8.2-4.el10_2
- RHSA-2026:36808 Released 2026-07-08 · Red Hat rating ImportantDevWorkspace Operator 0.42.0 release.
- DevWorkspace Operator 0.42 registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9, registry.redhat.io/devworkspace/devworkspace-rhel9-operator
- RHSA-2026:36796 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
- RHSA-2026:36797 Released 2026-07-08 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:36648 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Builds 1.7.4
- Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
- RHSA-2026:35833 Released 2026-07-06 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.s390x::container-tools:rhel8 +47
- RHSA-2026:26547 Released 2026-06-17 · Red Hat rating ImportantRHACS 4.10.4 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
- RHSA-2026:26546 Released 2026-06-17 · Red Hat rating ImportantRHACS 4.9.8 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
- RHSA-2026:23264 Released 2026-06-04 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.26-1.26.4-2.hum1@aarch64, golang1.26-1.26.4-2.hum1@src, golang1.26-1.26.4-2.hum1@x86_64 +10
- RHSA-2026:23262 Released 2026-06-04 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.25-1.25.11-2.hum1@aarch64, golang1.25-1.25.11-2.hum1@src, golang1.25-1.25.11-2.hum1@x86_64 +10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| External Secrets Operator for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322 |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:61314 |
| DevWorkspace Operator 0.42 | Fixed | RHSA-2026:36808 |
| Logging Subsystem for Red Hat OpenShift 6.5 | Fixed | RHSA-2026:70870 |
| Logging Subsystem for Red Hat OpenShift 6.6 | Fixed | RHSA-2026:66521 |
| OpenShift API for Data Protection 1.3 | Fixed | RHSA-2026:51033 |
| OpenShift API for Data Protection 1.4 | Fixed | RHSA-2026:59467 |
| OpenShift API for Data Protection 1.5 | Fixed | RHSA-2026:66022 |
| OpenShift API for Data Protection 1.6 | Fixed | RHSA-2026:43692 |
| RHEM 1.0 for RHEL 9 | Fixed | RHSA-2026:36796 |
| RHEM 1.1 for RHEL 10 | Fixed | RHSA-2026:41019 |
| RHEM 1.1 for RHEL 9 | Fixed | RHSA-2026:41019 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 | Fixed | RHSA-2026:41064 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:47737 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:54400 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:26546 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:26547 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:37072 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:35833 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:37123 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:51288 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:49944 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:67450 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:51288 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:49944 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:37072 |
| Red Hat Hardened Images | Fixed | RHSA-2026:23262, RHSA-2026:23264 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat OpenShift Builds 1.7.3 | Fixed | RHSA-2026:36648 |
| Red Hat OpenShift Builds 1.8.3 | Fixed | RHSA-2026:41036 |
| Red Hat OpenShift GitOps 1.19 | Fixed | RHSA-2026:52857 |
| Red Hat OpenShift GitOps 1.20 | Fixed | RHSA-2026:52910 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:41031 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:42146, RHSA-2026:43052 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:54395 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:36797, RHSA-2026:48771 |
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:46885 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:57194 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:47735 |
Not affected: 47 products
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Cluster Observability Operator 1.5
- DevWorkspace Operator 0.42
- ExternalDNS Operator
- Logging Subsystem for Red Hat OpenShift 6.5
- Logging Subsystem for Red Hat OpenShift 6.6
- OpenShift API for Data Protection 1.3
- OpenShift API for Data Protection 1.4
- OpenShift API for Data Protection 1.5
- OpenShift API for Data Protection 1.6
- RHEM 1.0 for RHEL 9
- RHEM 1.1 for RHEL 10
- RHEM 1.1 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Builds 1.7.3
- Red Hat OpenShift Builds 1.8.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift GitOps 1.19
- Red Hat OpenShift GitOps 1.20
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Data Foundation 4.22
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Trusted Artifact Signer 1.4
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42508
- 2026-10-03 Alias added: GHSA-5cgq-3rg8-m6cv
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-14 EPSS moved to the 50th–90th percentile
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
- 2026-10-23 EPSS moved to the 90th–95th percentile
- 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
- 2026-11-07 Affected versions changed · Red Hat
References
Other 29
- https://go.dev/issue/79568
- https://go.dev/cl/781220
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json
- https://cs.opensource.google/go/x/crypto
- https://bugzilla.redhat.com/show_bug.cgi?id=2480688
- https://access.redhat.com/security/cve/CVE-2026-42508
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40138
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:37123
- https://access.redhat.com/errata/RHSA-2026:37072
- https://access.redhat.com/errata/RHSA-2026:36808
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:35833
- https://access.redhat.com/errata/RHSA-2026:26547
- https://access.redhat.com/errata/RHSA-2026:26546
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:23262
More Go standard library Crypto vulnerabilities
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 10.0
- TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28714 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
- TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-42508 · CVE Program
- CVE-2026-42508 · NVD
- FIRST EPSS
- GHSA-5cgq-3rg8-m6cv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42508 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences