10.0
Critical
CVE-2026-46595 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
Description
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/crypto/ssh 0.52 | earliest → < 0.52.0 | 0.52.0 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1784638644 | earliest → < 1784638644 | 1784638644 |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1781686458 | earliest → < 1781686458 | 1781686458 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1781686446 | earliest → < 1781686446 | 1781686446 |
| Red Hat Hardened Images 1.26 | earliest → < 1.26.4-2.hum1 | 1.26.4-2.hum1 |
| multicluster engine for Kubernetes 2.8 1787266159 | earliest → < 1787266159 | 1787266159 |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Versions not published | |
| Builds for Red Hat OpenShift | Versions not published | |
| cert-manager Operator for Red Hat OpenShift | Versions not published |
Show the 62 other branches Hide the 62 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Confidential Compute Attestation | Versions not published | |
| Cryostat 4 | Versions not published | |
| External Secrets Operator for Red Hat OpenShift | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| OpenShift API for Data Protection | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Dev Workspaces Operator | Versions not published | |
| Red Hat OpenShift for Windows Containers | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift on AWS | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Security Profiles Operator | Versions not published | |
| Zero Trust Workload Identity Manager | Versions not published | |
| Zero Trust Workload Identity Manager - Tech Preview | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat Enterprise Linux AI 3.4 1782744830 | earliest → < 1782744830 | 1782744830 |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 1783352589 | earliest → < 1783352589 | 1783352589 |
| Red Hat OpenShift Builds 1.7.4 1783057868 | earliest → < 1783057868 | 1783057868 |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| DevWorkspace Operator 0.42 1782401674 | earliest → < 1782401674 | 1782401674 |
| Red Hat Edge Manager 1.0 1783502025 | earliest → < 1783502025 | 1783502025 |
| Red Hat OpenShift Dev Spaces 3.29 1782403274 | earliest → < 1782403274 | 1782403274 |
| Red Hat Trusted Artifact Signer 1.4 4 | earliest → < 4-1.4.2 | 4-1.4.2 |
| Red Hat OpenShift AI 3.3 1782471656 | earliest → < 1782471656 | 1782471656 |
| Red Hat Openshift Data Foundation 4.22 1782934284 | earliest → < 1782934284 | 1782934284 |
| Red Hat Edge Manager 1.1 1784126780 | earliest → < 1784126780 | 1784126780 |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published | |
| Red Hat OpenShift Builds 1.8.1 1783612119 | earliest → < 1783612119 | 1783612119 |
| Red Hat Advanced Cluster Security 4.9 1781686446 | earliest → < 1781686446 | 1781686446 |
| Red Hat OpenShift Builds 1.7.1 1783057868 | earliest → < 1783057868 | 1783057868 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| OpenShift API for Data Protection 1.6 1784058822 | earliest → < 1784058822 | 1784058822 |
| Red Hat OpenShift Builds 1.8.0 1783612119 | earliest → < 1783612119 | 1783612119 |
| Cryostat 4 on RHEL 9 4.2 | earliest → < 4.2.0-19 | 4.2.0-19 |
| Red Hat OpenShift Builds 1.7.3 1783057868 | earliest → < 1783057868 | 1783057868 |
| OpenShift API for Data Protection 1.3 1785180878 | earliest → < 1785180878 | 1785180878 |
| Cert Manager support for Red Hat OpenShift release 1.19 1786613805 | earliest → < 1786613805 | 1786613805 |
| OpenShift API for Data Protection 1.4 1786944540 | earliest → < 1786944540 | 1786944540 |
| Red Hat OpenShift AI 3.4 1787089049 | earliest → < 1787089049 | 1787089049 |
| ExternalDNS Operator | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Cluster Observability Operator 1.5.2 1787593637 | earliest → < 1787593637 | 1787593637 |
| Cluster Observability Operator 1.5.0 1787593637 | earliest → < 1787593637 | 1787593637 |
| Logging Subsystem for Red Hat OpenShift 6.6 1788439505 | earliest → < 1788439505 | 1788439505 |
| OpenShift API for Data Protection 1.5 1788860461 | earliest → < 1788860461 | 1788860461 |
References
- go.dev go.dev
- groups.google.com groups.google.com
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/crypto/ssh
The 15 CVEs of golang.org/x/crypto/ssh →
CVE-2026-78662
Previously, a channel registered in the mux's chanList is not usable until it is established
7.5
High
CVE-2026-56855
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the…
7.5
High
CVE-2026-56854
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the…
7.5
High
CVE-2026-39827
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory…
6.5
Medium