{"id":"CVE-2026-46595","title":"golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)","summary":"A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","cvssSource":"vendor","cwe":["CWE-303","CWE-863"],"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4.22","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","confidential_compute_attestation","external_secrets_operator_for_red_hat_openshift","multicluster_engine_for_kubernetes","openshift_pipelines","openshift_serverless","advanced_cluster_management_for_kubernetes 2","ceph_storage 9","enterprise_linux 10","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_for_windows_containers","openshift_gitops","openshift_on_aws","openshift_virtualization 4","quay 3","security_profiles_operator","zero_trust_workload_identity_manager","zero_trust_workload_identity_manager_tech_preview","rhem_1_1_for_rhel 10","cryostat_4_on_rhel 9","rhem_1_0_for_rhel 9","rhem_1_1_for_rhel 9","cert_manager_support_for_red_hat_openshift_release 1.19","cluster_observability_operator 1.5.0","devworkspace_operator 0.42","logging_subsystem_for_red_hat_openshift 6.6","openshift_api_for_data_protection 1.3","openshift_api_for_data_protection 1.4","openshift_api_for_data_protection 1.5","openshift_api_for_data_protection 1.6","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_security 4.9","advanced_cluster_security_for_kubernetes 4.10","advanced_cluster_security_for_kubernetes 4.11","edge_manager 1.0","edge_manager 1.1","enterprise_linux_ai 3.4"],"patched":["rhem_1_1_for_rhel 10","cryostat_4_on_rhel 9","rhem_1_0_for_rhel 9","rhem_1_1_for_rhel 9","cert_manager_support_for_red_hat_openshift_release 1.19","cluster_observability_operator 1.5.0","devworkspace_operator 0.42","logging_subsystem_for_red_hat_openshift 6.6","openshift_api_for_data_protection 1.3","openshift_api_for_data_protection 1.4","openshift_api_for_data_protection 1.5","openshift_api_for_data_protection 1.6","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_security 4.9","advanced_cluster_security_for_kubernetes 4.10","advanced_cluster_security_for_kubernetes 4.11","edge_manager 1.0","edge_manager 1.1","enterprise_linux_ai 3.4","hardened_images","openshift_ai 3.3","openshift_ai 3.4","openshift_builds 1.7.3","openshift_builds 1.8.1","openshift_dev_spaces 3.29","openshift_data_foundation 4.22","quay 3.15","trusted_artifact_signer 1.4","multicluster_engine_for_kubernetes 2.8"],"published":"2026-05-22","updated":"2026-09-19","sourceUpdated":"2026-09-19T17:33:45+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46595"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480689"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46595"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46595"},{"url":"https://go.dev/cl/781642"},{"url":"https://go.dev/issue/79570"},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI"},{"url":"https://pkg.go.dev/vuln/GO-2026-5023"},{"url":"https://access.redhat.com/errata/RHSA-2026:41019"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"url":"https://access.redhat.com/errata/RHSA-2026:36796"},{"url":"https://access.redhat.com/errata/RHSA-2026:54531"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"url":"https://access.redhat.com/errata/RHSA-2026:36808"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"url":"https://access.redhat.com/errata/RHSA-2026:51033"},{"url":"https://access.redhat.com/errata/RHSA-2026:59467"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022"},{"url":"https://access.redhat.com/errata/RHSA-2026:43692"},{"url":"https://access.redhat.com/errata/RHSA-2026:30651"},{"url":"https://access.redhat.com/errata/RHSA-2026:47737"},{"url":"https://access.redhat.com/errata/RHSA-2026:26546"},{"url":"https://access.redhat.com/errata/RHSA-2026:26547"},{"url":"https://access.redhat.com/errata/RHSA-2026:36207"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"url":"https://access.redhat.com/errata/RHSA-2026:33531"},{"url":"https://access.redhat.com/errata/RHSA-2026:33524"},{"url":"https://access.redhat.com/errata/RHSA-2026:23262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23264","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30650","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36648","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36797","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41036","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59558","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337"},{"url":"https://github.com/advisories/GHSA-x527-x647-q7gg"}],"tags":["csaf","vex","red-hat","cve.org","nvd","ghsa","go","score-dispute"],"epss":0.00503,"epssPercentile":0.41918,"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-22T18:21:12.222019Z"},"scores":{"vendor":7.1,"adp":10,"nvd":10},"ingestedAt":"2026-06-26T16:43:14.191Z","slug":"CVE-2026-46595","body":"## Overview\n\nA flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.\n\n## Vendor advisories\n\n- **RHSA-2026:41019** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41019)\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:36796** · Red Hat · fixed in: RHEM 1.0 for RHEL 9 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36796)\n- **RHSA-2026:54531** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54531)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:36808** · Red Hat · fixed in: DevWorkspace Operator 0.42 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36808)\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **RHSA-2026:51033** · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51033)\n- **RHSA-2026:59467** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59467)\n- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)\n- **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Multicluster Engine for Kubernetes, OpenShift Pipelines, OpenShift Serverless, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Container Platform 4, … · updated 2026-09-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json)\n- **RHSA-2026:30651** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-06-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:30651)\n- **RHSA-2026:47737** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47737)\n\n**golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation** — rated Important by Red Hat. Released 2026-05-22, updated 2026-09-19.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Confidential Compute Attestation\n- External Secrets Operator for Red Hat OpenShift\n- Multicluster Engine for Kubernetes\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift for Windows Containers\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift on AWS\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Security Profiles Operator\n- Zero Trust Workload Identity Manager\n- Zero Trust Workload Identity Manager - Tech Preview\n\nFixed:\n\n- RHEM 1.1 for RHEL 10\n- Cryostat 4 on RHEL 9\n- RHEM 1.0 for RHEL 9\n- RHEM 1.1 for RHEL 9\n- Cert Manager support for Red Hat OpenShift release 1.19\n- Cluster Observability Operator 1.5.0\n- DevWorkspace Operator 0.42\n- Logging Subsystem for Red Hat OpenShift 6.6\n- OpenShift API for Data Protection 1.3\n- OpenShift API for Data Protection 1.4\n- OpenShift API for Data Protection 1.5\n- OpenShift API for Data Protection 1.6\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Security 4.9\n- Red Hat Advanced Cluster Security for Kubernetes 4.10\n- Red Hat Advanced Cluster Security for Kubernetes 4.11\n- Red Hat Edge Manager 1.0\n- Red Hat Edge Manager 1.1\n- Red Hat Enterprise Linux AI 3.4\n- Red Hat Hardened Images\n- Red Hat OpenShift AI 3.3\n- Red Hat OpenShift AI 3.4\n- Red Hat OpenShift Builds 1.7.3\n- Red Hat OpenShift Builds 1.8.1\n- Red Hat OpenShift Dev Spaces 3.29\n- Red Hat Openshift Data Foundation 4.22\n- Red Hat Quay 3.15\n- Red Hat Trusted Artifact Signer 1.4\n- multicluster engine for Kubernetes 2.8\n\nNo fix planned:\n\n- Confidential Compute Attestation\n- External Secrets Operator for Red Hat OpenShift\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift Container Platform 4\n- Zero Trust Workload Identity Manager\n- Zero Trust Workload Identity Manager - Tech Preview\n- Red Hat Ceph Storage 9\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Multicluster Engine for Kubernetes\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift for Windows Containers\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift on AWS\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Security Profiles Operator\n\nNot affected:\n\n- RHEM 1.1 for RHEL 10\n- Cryostat 4 on RHEL 9\n- RHEM 1.0 for RHEL 9\n- RHEM 1.1 for RHEL 9\n- Cert Manager support for Red Hat OpenShift release 1.19\n- Cluster Observability Operator 1.5.0\n- DevWorkspace Operator 0.42\n- Logging Subsystem for Red Hat OpenShift 6.6\n- OpenShift API for Data Protection 1.3\n- OpenShift API for Data Protection 1.4\n\n## Remediation\n\nSee the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:41019\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48151\nSee the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.0 https://access.redhat.com/errata/RHSA-2026:36796\n\n## Package advisory (CVE-2026-46595)\n\nAffected packages:\n\n- `golang.org/x/crypto/ssh < 0.52.0`\n\nPatched in:\n\n- `golang.org/x/crypto/ssh 0.52.0`\n\nSource: https://github.com/advisories/GHSA-x527-x647-q7gg","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208065,"id":"CVE-2026-46595","ts":1789922701118,"field":"cvss","old":"10","new":"7.1"},{"seq":208064,"id":"CVE-2026-46595","ts":1789922701118,"field":"severity","old":"critical","new":"high"},{"seq":201696,"id":"CVE-2026-46595","ts":1789399607074,"field":"cvss","old":"7.1","new":"10"},{"seq":201695,"id":"CVE-2026-46595","ts":1789399607074,"field":"severity","old":"high","new":"critical"},{"seq":200428,"id":"CVE-2026-46595","ts":1789397238051,"field":"cvss","old":"10","new":"7.1"},{"seq":200427,"id":"CVE-2026-46595","ts":1789397238051,"field":"severity","old":"critical","new":"high"},{"seq":198352,"id":"CVE-2026-46595","ts":1789391858940,"field":"cvss","old":"7.1","new":"10"},{"seq":198351,"id":"CVE-2026-46595","ts":1789391858940,"field":"severity","old":"high","new":"critical"},{"seq":196143,"id":"CVE-2026-46595","ts":1789383510118,"field":"cvss","old":"10","new":"7.1"},{"seq":196142,"id":"CVE-2026-46595","ts":1789383510118,"field":"severity","old":"critical","new":"high"},{"seq":195072,"id":"CVE-2026-46595","ts":1789380376241,"field":"cvss","old":"7.1","new":"10"},{"seq":195071,"id":"CVE-2026-46595","ts":1789380376241,"field":"severity","old":"high","new":"critical"},{"seq":193859,"id":"CVE-2026-46595","ts":1789378358629,"field":"cvss","old":"10","new":"7.1"},{"seq":193858,"id":"CVE-2026-46595","ts":1789378358629,"field":"severity","old":"critical","new":"high"},{"seq":192646,"id":"CVE-2026-46595","ts":1789376326392,"field":"cvss","old":"7.1","new":"10"},{"seq":192645,"id":"CVE-2026-46595","ts":1789376326392,"field":"severity","old":"high","new":"critical"},{"seq":191433,"id":"CVE-2026-46595","ts":1789373267956,"field":"cvss","old":"10","new":"7.1"},{"seq":191432,"id":"CVE-2026-46595","ts":1789373267956,"field":"severity","old":"critical","new":"high"},{"seq":190218,"id":"CVE-2026-46595","ts":1789369204855,"field":"cvss","old":"7.1","new":"10"},{"seq":190217,"id":"CVE-2026-46595","ts":1789369204855,"field":"severity","old":"high","new":"critical"},{"seq":189005,"id":"CVE-2026-46595","ts":1789368134639,"field":"cvss","old":"10","new":"7.1"},{"seq":189004,"id":"CVE-2026-46595","ts":1789368134639,"field":"severity","old":"critical","new":"high"},{"seq":187788,"id":"CVE-2026-46595","ts":1789365065953,"field":"cvss","old":"7.1","new":"10"},{"seq":187787,"id":"CVE-2026-46595","ts":1789365065953,"field":"severity","old":"high","new":"critical"},{"seq":186575,"id":"CVE-2026-46595","ts":1789363103608,"field":"cvss","old":"10","new":"7.1"},{"seq":186574,"id":"CVE-2026-46595","ts":1789363103608,"field":"severity","old":"critical","new":"high"},{"seq":185361,"id":"CVE-2026-46595","ts":1789361028644,"field":"cvss","old":"7.1","new":"10"},{"seq":185360,"id":"CVE-2026-46595","ts":1789361028644,"field":"severity","old":"high","new":"critical"},{"seq":184148,"id":"CVE-2026-46595","ts":1789358034891,"field":"cvss","old":"10","new":"7.1"},{"seq":184147,"id":"CVE-2026-46595","ts":1789358034891,"field":"severity","old":"critical","new":"high"},{"seq":182399,"id":"CVE-2026-46595","ts":1789354158319,"field":"cvss","old":"7.1","new":"10"},{"seq":182398,"id":"CVE-2026-46595","ts":1789354158319,"field":"severity","old":"high","new":"critical"},{"seq":181192,"id":"CVE-2026-46595","ts":1789353003786,"field":"cvss","old":"10","new":"7.1"},{"seq":181191,"id":"CVE-2026-46595","ts":1789353003786,"field":"severity","old":"critical","new":"high"},{"seq":179985,"id":"CVE-2026-46595","ts":1789350083601,"field":"cvss","old":"7.1","new":"10"},{"seq":179984,"id":"CVE-2026-46595","ts":1789350083601,"field":"severity","old":"high","new":"critical"},{"seq":178778,"id":"CVE-2026-46595","ts":1789347953439,"field":"cvss","old":"10","new":"7.1"},{"seq":178777,"id":"CVE-2026-46595","ts":1789347953439,"field":"severity","old":"critical","new":"high"},{"seq":177571,"id":"CVE-2026-46595","ts":1789346221067,"field":"cvss","old":"7.1","new":"10"},{"seq":177570,"id":"CVE-2026-46595","ts":1789346221067,"field":"severity","old":"high","new":"critical"},{"seq":176364,"id":"CVE-2026-46595","ts":1789342871490,"field":"cvss","old":"10","new":"7.1"},{"seq":176363,"id":"CVE-2026-46595","ts":1789342871490,"field":"severity","old":"critical","new":"high"},{"seq":175818,"id":"CVE-2026-46595","ts":1789338654723,"field":"cvss","old":"7.1","new":"10"},{"seq":175817,"id":"CVE-2026-46595","ts":1789338654723,"field":"severity","old":"high","new":"critical"},{"seq":175688,"id":"CVE-2026-46595","ts":1789338474404,"field":"cvss","old":"10","new":"7.1"},{"seq":175687,"id":"CVE-2026-46595","ts":1789338474404,"field":"severity","old":"critical","new":"high"},{"seq":174483,"id":"CVE-2026-46595","ts":1789334664040,"field":"cvss","old":"7.1","new":"10"},{"seq":174482,"id":"CVE-2026-46595","ts":1789334664040,"field":"severity","old":"high","new":"critical"},{"seq":173278,"id":"CVE-2026-46595","ts":1789333342795,"field":"cvss","old":"10","new":"7.1"},{"seq":173277,"id":"CVE-2026-46595","ts":1789333342795,"field":"severity","old":"critical","new":"high"}]}