جزئیات آسیب‌پذیری
CVE-2026-46595
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2Red Hat Confidential Compute AttestationRed Hat External Secrets Operator for Red Hat OpenShiftRed Hat Multicluster Engine for KubernetesRed Hat OpenShift PipelinesRed Hat OpenShift Serverless
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
CVSS 3.1
7.1بالا
شرح رسمی (انگلیسی)
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 10.0بحرانی | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| 7.1بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Confidential Compute Attestation | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | External Secrets Operator for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ceph Storage 9 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift for Windows Containers | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift on AWS | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Security Profiles Operator | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview | همه | CVEProject cvelistV5 (CNA) |
| golang.org/x/crypto | golang.org/x/crypto/ssh | v < 0.52.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۴۰- https://go.dev/issue/79570
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781642
- https://pkg.go.dev/vuln/GO-2026-5023
- https://access.redhat.com/security/cve/CVE-2026-46595 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2480689 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:41019 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48151 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54531 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61314 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36808 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66521 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51033 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59467 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66022 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43692 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:47737 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26546 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26547 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36207 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40945 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40118 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33531 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33524 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23262 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23264 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36648 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41036 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37387 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36797 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30650 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59558 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۳/۰۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۰
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- Go
پیش‌بینی بهره‌برداری (EPSS)
۰٫۵۵٪
احتمال بهره‌برداری در ۳۰ روز
۴۶٫۵٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-863Incorrect Authorization
- CWE-303Incorrect Implementation of Authentication Algorithm