Vulnerability details
CVE-2026-39828
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2Red Hat Confidential Compute AttestationRed Hat External Secrets Operator for Red Hat OpenShiftRed Hat Multicluster Engine for KubernetesRed Hat OpenShift PipelinesRed Hat OpenShift Serverless
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
CVSS 3.1
8.8High
Official description
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 6.3Medium | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Confidential Compute Attestation | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Confidential Compute Attestation | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Confidential Compute Attestation | All | CVEProject cvelistV5 (CNA) |
| Red Hat | External Secrets Operator for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Security 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Security 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Security 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ceph Storage 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Dev Spaces | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift for Windows Containers | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift for Windows Containers | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift on AWS | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenStack Platform 18.0 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Artifact Signer | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Artifact Signer | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Artifact Signer | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Security Profiles Operator | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Security Profiles Operator | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview | All | CVEProject cvelistV5 (CNA) |
| golang.org/x/crypto | golang.org/x/crypto/ssh | v < 0.52.0 | CVEProject cvelistV5 (CNA) |
References and advisories
56- https://access.redhat.com/errata/RHSA-2026:42146 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43052 vendor-advisoryx_refsource_REDHAT
- https://go.dev/issue/79562
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781621
- https://pkg.go.dev/vuln/GO-2026-5014
- https://access.redhat.com/security/cve/CVE-2026-39828 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2480687 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:41019 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48151 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54531 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36808 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66521 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51033 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59467 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66022 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43692 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46903 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57191 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26546 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36319 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26547 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36625 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36207 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40945 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40118 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36648 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41036 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51038 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:52857 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:52910 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37387 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41031 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41066 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40262 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40972 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40974 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40969 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36797 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37271 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37268 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37272 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37278 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37286 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37296 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57194 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46885 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36105 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36167 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41055 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:47735 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-22
- Last updated
- 2026-09-18
- State
- Published
- Assigner (CNA)
- Go
Exploit prediction (EPSS)
0.36%
Probability of exploitation in 30 days
30.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-281Improper Preservation of Permissions