{"id":"CVE-2026-39828","title":"Invoking  bypass of certificate restrictions in golang.org/x/crypto/ssh","summary":"When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succee…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvssSource":"adp","cwe":["CWE-863","CWE-295","CWE-281"],"vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh","affected":["golang.org/x/crypto/ssh < 0.52.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-22T17:43:55.428395Z"},"published":"2026-05-22","updated":"2026-09-18","sourceUpdated":"2026-09-18T12:04:45.475Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-39828","references":[{"url":"https://go.dev/issue/79562"},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI"},{"url":"https://go.dev/cl/781621"},{"url":"https://pkg.go.dev/vuln/GO-2026-5014"},{"url":"https://access.redhat.com/errata/RHSA-2026:26546","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26547","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36105","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36167","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36207","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36319","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36625","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36648","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36797","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36808","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37268","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37271","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37278","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37286","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37296","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40969","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40972","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40974","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41019","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41036","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41055","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43692","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46885","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46903","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:47735","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51033","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51038","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52857","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52910","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54531","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57194","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59467","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-39828","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480687","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39828"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39828"},{"url":"https://github.com/advisories/GHSA-45gg-vh54-h5m9"}],"tags":["cve.org","nvd","csaf","vex","red-hat","ghsa","go","score-dispute"],"epss":0.00369,"epssPercentile":0.30755,"ecosystem":"go","patched":["crypto 0.52.0"],"scores":{"adp":6.3,"nvd":6.3,"vendor":8.8},"ingestedAt":"2026-06-26T16:43:14.198Z","slug":"CVE-2026-39828","body":"## Overview\n\nWhen an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.\n\n## Affected\n\n- `golang.org/x/crypto/ssh < 0.52.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-39828)\n\nAffected packages:\n\n- `golang.org/x/crypto/ssh < 0.52.0`\n\nPatched in:\n\n- `golang.org/x/crypto/ssh 0.52.0`\n\nSource: https://github.com/advisories/GHSA-45gg-vh54-h5m9\n\n## Vendor advisories\n\n- **RHSA-2026:41019** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41019)\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:36796** · Red Hat · fixed in: RHEM 1.0 for RHEL 9 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36796)\n- **RHSA-2026:54531** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54531)\n- **RHSA-2026:36808** · Red Hat · fixed in: DevWorkspace Operator 0.42 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36808)\n- **RHSA-2026:51033** · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51033)\n- **RHSA-2026:59467** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59467)\n- **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692)\n- **RHSA-2026:46903** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:46903)\n- **RHSA-2026:57191** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57191)\n- **RHSA-2026:26546** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26546)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Logging Subsystem for Red Hat OpenShift, Multicluster Engine for Kubernetes, OpenShift Pipelines, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4, Red Hat OpenShift GitOps, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json)","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201620,"id":"CVE-2026-39828","ts":1789399557468,"field":"cvss","old":"8.8","new":"6.3"},{"seq":201619,"id":"CVE-2026-39828","ts":1789399557468,"field":"severity","old":"high","new":"medium"},{"seq":200352,"id":"CVE-2026-39828","ts":1789397154148,"field":"cvss","old":"6.3","new":"8.8"},{"seq":200351,"id":"CVE-2026-39828","ts":1789397154148,"field":"severity","old":"medium","new":"high"},{"seq":198276,"id":"CVE-2026-39828","ts":1789391789819,"field":"cvss","old":"8.8","new":"6.3"},{"seq":198275,"id":"CVE-2026-39828","ts":1789391789819,"field":"severity","old":"high","new":"medium"},{"seq":196069,"id":"CVE-2026-39828","ts":1789383440757,"field":"cvss","old":"6.3","new":"8.8"},{"seq":196068,"id":"CVE-2026-39828","ts":1789383440757,"field":"severity","old":"medium","new":"high"},{"seq":194998,"id":"CVE-2026-39828","ts":1789380342902,"field":"cvss","old":"8.8","new":"6.3"},{"seq":194997,"id":"CVE-2026-39828","ts":1789380342902,"field":"severity","old":"high","new":"medium"},{"seq":193785,"id":"CVE-2026-39828","ts":1789378306385,"field":"cvss","old":"6.3","new":"8.8"},{"seq":193784,"id":"CVE-2026-39828","ts":1789378306385,"field":"severity","old":"medium","new":"high"},{"seq":192572,"id":"CVE-2026-39828","ts":1789376286972,"field":"cvss","old":"8.8","new":"6.3"},{"seq":192571,"id":"CVE-2026-39828","ts":1789376286972,"field":"severity","old":"high","new":"medium"},{"seq":191359,"id":"CVE-2026-39828","ts":1789373162284,"field":"cvss","old":"6.3","new":"8.8"},{"seq":191358,"id":"CVE-2026-39828","ts":1789373162284,"field":"severity","old":"medium","new":"high"},{"seq":190144,"id":"CVE-2026-39828","ts":1789369160786,"field":"cvss","old":"8.8","new":"6.3"},{"seq":190143,"id":"CVE-2026-39828","ts":1789369160786,"field":"severity","old":"high","new":"medium"},{"seq":188931,"id":"CVE-2026-39828","ts":1789368060272,"field":"cvss","old":"6.3","new":"8.8"},{"seq":188930,"id":"CVE-2026-39828","ts":1789368060272,"field":"severity","old":"medium","new":"high"},{"seq":187714,"id":"CVE-2026-39828","ts":1789365034400,"field":"cvss","old":"8.8","new":"6.3"},{"seq":187713,"id":"CVE-2026-39828","ts":1789365034400,"field":"severity","old":"high","new":"medium"},{"seq":186501,"id":"CVE-2026-39828","ts":1789363047821,"field":"cvss","old":"6.3","new":"8.8"},{"seq":186500,"id":"CVE-2026-39828","ts":1789363047821,"field":"severity","old":"medium","new":"high"},{"seq":185287,"id":"CVE-2026-39828","ts":1789360993800,"field":"cvss","old":"8.8","new":"6.3"},{"seq":185286,"id":"CVE-2026-39828","ts":1789360993800,"field":"severity","old":"high","new":"medium"},{"seq":184074,"id":"CVE-2026-39828","ts":1789357977768,"field":"cvss","old":"6.3","new":"8.8"},{"seq":184073,"id":"CVE-2026-39828","ts":1789357977768,"field":"severity","old":"medium","new":"high"},{"seq":182326,"id":"CVE-2026-39828","ts":1789354135989,"field":"cvss","old":"8.8","new":"6.3"},{"seq":182325,"id":"CVE-2026-39828","ts":1789354135989,"field":"severity","old":"high","new":"medium"},{"seq":181119,"id":"CVE-2026-39828","ts":1789352975027,"field":"cvss","old":"6.3","new":"8.8"},{"seq":181118,"id":"CVE-2026-39828","ts":1789352975027,"field":"severity","old":"medium","new":"high"},{"seq":179912,"id":"CVE-2026-39828","ts":1789350046300,"field":"cvss","old":"8.8","new":"6.3"},{"seq":179911,"id":"CVE-2026-39828","ts":1789350046300,"field":"severity","old":"high","new":"medium"},{"seq":178705,"id":"CVE-2026-39828","ts":1789347886511,"field":"cvss","old":"6.3","new":"8.8"},{"seq":178704,"id":"CVE-2026-39828","ts":1789347886511,"field":"severity","old":"medium","new":"high"},{"seq":177498,"id":"CVE-2026-39828","ts":1789346200166,"field":"cvss","old":"8.8","new":"6.3"},{"seq":177497,"id":"CVE-2026-39828","ts":1789346200166,"field":"severity","old":"high","new":"medium"},{"seq":176291,"id":"CVE-2026-39828","ts":1789342792681,"field":"cvss","old":"6.3","new":"8.8"},{"seq":176290,"id":"CVE-2026-39828","ts":1789342792681,"field":"severity","old":"medium","new":"high"},{"seq":175745,"id":"CVE-2026-39828","ts":1789338583276,"field":"cvss","old":"8.8","new":"6.3"},{"seq":175744,"id":"CVE-2026-39828","ts":1789338583276,"field":"severity","old":"high","new":"medium"},{"seq":175615,"id":"CVE-2026-39828","ts":1789338417359,"field":"cvss","old":"6.3","new":"8.8"},{"seq":175614,"id":"CVE-2026-39828","ts":1789338417359,"field":"severity","old":"medium","new":"high"},{"seq":174410,"id":"CVE-2026-39828","ts":1789334632474,"field":"cvss","old":"8.8","new":"6.3"},{"seq":174409,"id":"CVE-2026-39828","ts":1789334632474,"field":"severity","old":"high","new":"medium"},{"seq":173205,"id":"CVE-2026-39828","ts":1789333262619,"field":"cvss","old":"6.3","new":"8.8"},{"seq":173204,"id":"CVE-2026-39828","ts":1789333262619,"field":"severity","old":"medium","new":"high"},{"seq":172019,"id":"CVE-2026-39828","ts":1789330918519,"field":"cvss","old":"8.8","new":"6.3"},{"seq":172018,"id":"CVE-2026-39828","ts":1789330918519,"field":"severity","old":"high","new":"medium"}]}