Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Priority MEDIUM 50CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 33 fixed, 21 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00556 46th percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh (golang.org/x/crypto): 0.52.0golang.org/x/crypto (Go): 0.52.0Red Hat: 43 advisoriesRed Hat: 33 fixed, 21 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | golang.org/x/crypto/ssh | before 0.52.0 | 0.52.0 | Patch available | CNA |
| — | golang.org/x/crypto (Go) | before 0.52.0 | 0.52.0 | Patch available | GHSA-x527-x647-q7gg |
- golang.org/x/crypto/ssh VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
- golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-x527-x647-q7gg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* | before 0.52.0 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* Versions before 0.52.0 Vulnerable ·Go standard library
Remediation
- Fix · CNA golang.org/x/crypto/ssh (golang.org/x/crypto) Fixed in 0.52.0
- Fix · GHSA-x527-x647-q7gg golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →
Red Hat 43 advisories
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:76752 Released 2026-10-06 · Red Hat rating ImportantOpenShift Security Profiles Operator bug fix and enhancement update
- OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
Show 40 more Red Hat advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:70870 Released 2026-09-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.5.3
- Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:66521 Released 2026-09-10 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.6.1
- Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
- RHSA-2026:66022 Released 2026-09-09 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
- RHSA-2026:61314 Released 2026-08-31 · Red Hat rating ImportantCluster Observability Operator 1.5.2
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.10 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
- RHSA-2026:59467 Released 2026-08-25 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
- RHSA-2026:54531 Released 2026-08-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.19.1
- Cert Manager support for Red Hat OpenShift release 1.19 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:51033 Released 2026-08-06 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
- RHSA-2026:50888 Released 2026-08-05 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:49767 Released 2026-08-03 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48771 Released 2026-07-30 · Red Hat rating ImportantRHTAS 1.4.3 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:47737 Released 2026-07-29 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
- RHSA-2026:43692 Released 2026-07-22 · Red Hat rating ImportantRed Hat OpenShift API for Data Protection
- OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:41036 Released 2026-07-16 · Red Hat rating ImportantRed Hat OpenShift Builds 1.8.1
- Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
- RHSA-2026:41019 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
- RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:37276 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:37275 Released 2026-07-09 · Red Hat rating CriticalRHOAI 3.3.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:36808 Released 2026-07-08 · Red Hat rating ImportantDevWorkspace Operator 0.42.0 release.
- DevWorkspace Operator 0.42 registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9, registry.redhat.io/devworkspace/devworkspace-rhel9-operator
- RHSA-2026:36796 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
- RHSA-2026:36797 Released 2026-07-08 · Red Hat rating ImportantRHTAS 1.4.2 - CLI Stack Release
- Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:36648 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Builds 1.7.4
- Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
- RHSA-2026:36207 Released 2026-07-07 · Red Hat rating ImportantRHACS 4.11.1 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator +4
- RHSA-2026:33531 Released 2026-06-30 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.1 enhancement update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:33524 Released 2026-06-30 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.1 enhancement update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:30651 Released 2026-06-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18
- RHSA-2026:30650 Released 2026-06-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.8 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
- RHSA-2026:26547 Released 2026-06-17 · Red Hat rating ImportantRHACS 4.10.4 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
- RHSA-2026:26546 Released 2026-06-17 · Red Hat rating ImportantRHACS 4.9.8 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
- RHSA-2026:23264 Released 2026-06-04 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.26-1.26.4-2.hum1@aarch64, golang1.26-1.26.4-2.hum1@src, golang1.26-1.26.4-2.hum1@x86_64 +10
- RHSA-2026:23262 Released 2026-06-04 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.25-1.25.11-2.hum1@aarch64, golang1.25-1.25.11-2.hum1@src, golang1.25-1.25.11-2.hum1@x86_64 +10
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
golang.org/x/crypto/ssh 0.52.0
9 records Highest priority Priority MEDIUM 4 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshPriority MEDIUM 48
- TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshPriority MEDIUM 46
- TI-2026-28712 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshPriority MEDIUM 46
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet |
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| External Secrets Operator for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Zero Trust Workload Identity Manager | Affected | No fix planned: Will not fix |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix planned: Will not fix |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322 |
| Cert Manager support for Red Hat OpenShift release 1.19 | Fixed | RHSA-2026:54531 |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:61314 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| DevWorkspace Operator 0.42 | Fixed | RHSA-2026:36808 |
| Logging Subsystem for Red Hat OpenShift 6.5 | Fixed | RHSA-2026:70870 |
| Logging Subsystem for Red Hat OpenShift 6.6 | Fixed | RHSA-2026:66521 |
| OpenShift API for Data Protection 1.3 | Fixed | RHSA-2026:51033 |
| OpenShift API for Data Protection 1.4 | Fixed | RHSA-2026:59467 |
| OpenShift API for Data Protection 1.5 | Fixed | RHSA-2026:66022 |
| OpenShift API for Data Protection 1.6 | Fixed | RHSA-2026:43692 |
| OpenShift Security Profiles Operator 1 | Fixed | RHSA-2026:76752 |
| RHEM 1.0 for RHEL 9 | Fixed | RHSA-2026:36796 |
| RHEM 1.1 for RHEL 10 | Fixed | RHSA-2026:41019 |
| RHEM 1.1 for RHEL 9 | Fixed | RHSA-2026:41019 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:30651, RHSA-2026:47737 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:26546 |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 | Fixed | RHSA-2026:36207 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:26547 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Enterprise Linux AI 3.4 | Fixed | RHSA-2026:33524, RHSA-2026:33531 |
| Red Hat Hardened Images | Fixed | RHSA-2026:23262, RHSA-2026:23264 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:37275, RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat OpenShift Builds 1.7.3 | Fixed | RHSA-2026:36648 |
| Red Hat OpenShift Builds 1.8.3 | Fixed | RHSA-2026:41036 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:36797, RHSA-2026:48771 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:30650, RHSA-2026:59558 |
Not affected: 41 products
- Cert Manager support for Red Hat OpenShift release 1.19
- Cluster Observability Operator 1.5
- Cryostat 4 on RHEL 9
- DevWorkspace Operator 0.42
- ExternalDNS Operator
- Logging Subsystem for Red Hat OpenShift 6.5
- Logging Subsystem for Red Hat OpenShift 6.6
- OpenShift API for Data Protection 1.3
- OpenShift API for Data Protection 1.4
- OpenShift API for Data Protection 1.5
- OpenShift API for Data Protection 1.6
- OpenShift Security Profiles Operator 1
- RHEM 1.0 for RHEL 9
- RHEM 1.1 for RHEL 10
- RHEM 1.1 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes 4.11
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Builds 1.7.3
- Red Hat OpenShift Builds 1.8.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Openshift Data Foundation 4.22
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Trusted Artifact Signer 1.4
- multicluster engine for Kubernetes 2.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46595
- 2026-10-03 Alias added: GHSA-x527-x647-q7gg
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
- 2026-10-07 Fix available: OpenShift Security Profiles Operator 1 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
- 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
- 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
References
Advisory 3
Other 28
- https://go.dev/issue/79570
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781642
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json
- https://cs.opensource.google/go/x/crypto
- https://bugzilla.redhat.com/show_bug.cgi?id=2480689
- https://access.redhat.com/security/cve/CVE-2026-46595
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:36808
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:33531
- https://access.redhat.com/errata/RHSA-2026:33524
- https://access.redhat.com/errata/RHSA-2026:30651
- https://access.redhat.com/errata/RHSA-2026:30650
- https://access.redhat.com/errata/RHSA-2026:26547
- https://access.redhat.com/errata/RHSA-2026:26546
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:23262
More Go standard library Crypto vulnerabilities
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2026-30791 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVSS 3.1CRITICAL 9.1
- TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28714 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
- TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
- TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-46595 · CVE Program
- CVE-2026-46595 · NVD
- FIRST EPSS
- GHSA-x527-x647-q7gg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-46595 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences