CVE-2026-39831High· 8.1▾ Twilight

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 22, 2026

Updated

Sep 17, 2026

CVSS

8.1

Vendor

Red Hat

Product

Red Hat Openshift Data Foundation 4.22

CWE

CWE-347, CWE-862

Depth score

45 · Moderate

EPSS

0.42% · p36

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 4.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

10 events · 118 days

May 22, 2026Published
Disclosed via CSAF
Jul 4, 2026EPSS first tracked
0.4%
Jul 24, 2026EPSS peak
0.4% → 0.4%
Sep 8, 2026CVSS changed
9.1 → 8.1
Sep 8, 2026Severity changed
critical → high
Sep 8, 2026CVSS changed
8.1 → 9.1
Sep 8, 2026Severity changed
high → critical
Sep 8, 2026CVSS changed
9.1 → 8.1
Sep 8, 2026Severity changed
critical → high
Sep 17, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-347 CWE-862 #csaf #vex #red-hat #osv #go #ghsa

Affected

Patched in

rhem_1_1_for_rhel 10
rhem_1_1_for_rhel 9
enterprise_linux_appstream_eus_v_9_6
cluster_observability_operator 1.5.0
logging_subsystem_for_red_hat_openshift 6.6
openshift_api_for_data_protection 1.3
openshift_api_for_data_protection 1.4
openshift_api_for_data_protection 1.5
openshift_api_for_data_protection 1.6
advanced_cluster_management_for_kubernetes 2.16
advanced_cluster_security 4.9
advanced_cluster_security_for_kubernetes 4.10
openshift_ai 3.4
openshift_container_platform 4.21
openshift_container_platform 4.22
openshift_dev_spaces 3.30
openshift_gitops 1.19
openshift_gitops 1.20
openshift_data_foundation 4.22
quay 3.10
quay 3.15
quay 3.16
quay 3.9
trusted_artifact_signer 1.3
trusted_artifact_signer 1.4
multicluster_engine_for_kubernetes 2.11
multicluster_engine_for_kubernetes 2.1
multicluster_engine_for_kubernetes 2.6
multicluster_engine_for_kubernetes 2.8
multicluster_engine_for_kubernetes 2.9

Full technical detail▾

Overview

A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.

Vendor advisories

RHSA-2026:68334 · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:67450 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-14 · advisory
RHSA-2026:61314 · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · advisory
RHSA-2026:66521 · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · advisory
RHSA-2026:51033 · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · advisory
RHSA-2026:59467 · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · advisory
RHSA-2026:66022 · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · advisory
RHSA-2026:43692 · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · advisory
RHSA-2026:54400 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-12 · advisory
RHSA-2026:36319 · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-07-07 · advisory
RHSA-2026:36625 · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-08 · advisory
Red Hat VEX · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Multicluster Engine for Kubernetes, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4, Zero Trust Workload Identity Manager - Tech Preview, … · updated 2026-09-17 · vex
RHSA-2026:60520 · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · advisory
RHSA-2026:57801 · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-08-25 · advisory
RHSA-2026:54770 · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-18 · advisory
RHSA-2026:62260 · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · advisory

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check — rated Important by Red Hat. Released 2026-05-22, updated 2026-09-17.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
External Secrets Operator for Red Hat OpenShift
Multicluster Engine for Kubernetes
OpenShift Pipelines
OpenShift Serverless
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Ceph Storage 9
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift for Windows Containers
Red Hat OpenShift GitOps
Red Hat OpenShift on AWS
Red Hat OpenShift Virtualization 4
Red Hat Quay 3
Red Hat Trusted Artifact Signer
Security Profiles Operator
Zero Trust Workload Identity Manager
Zero Trust Workload Identity Manager - Tech Preview

Fixed:

RHEM 1.1 for RHEL 10
RHEM 1.1 for RHEL 9
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Cluster Observability Operator 1.5.0
Logging Subsystem for Red Hat OpenShift 6.6
OpenShift API for Data Protection 1.3
OpenShift API for Data Protection 1.4
OpenShift API for Data Protection 1.5
OpenShift API for Data Protection 1.6
Red Hat Advanced Cluster Management for Kubernetes 2.16
Red Hat Advanced Cluster Security 4.9
Red Hat Advanced Cluster Security for Kubernetes 4.10
Red Hat OpenShift AI 3.4
Red Hat OpenShift Container Platform 4.21
Red Hat OpenShift Container Platform 4.22
Red Hat OpenShift Dev Spaces 3.30
Red Hat OpenShift GitOps 1.19
Red Hat OpenShift GitOps 1.20
Red Hat Openshift Data Foundation 4.22
Red Hat Quay 3.10
Red Hat Quay 3.15
Red Hat Quay 3.16
Red Hat Quay 3.9
Red Hat Trusted Artifact Signer 1.3
Red Hat Trusted Artifact Signer 1.4
multicluster engine for Kubernetes 2.11
multicluster engine for Kubernetes 2.1
multicluster engine for Kubernetes 2.6
multicluster engine for Kubernetes 2.8
multicluster engine for Kubernetes 2.9

No fix planned:

Confidential Compute Attestation
External Secrets Operator for Red Hat OpenShift
Red Hat OpenShift Container Platform 4
Zero Trust Workload Identity Manager - Tech Preview
Red Hat Ceph Storage 9
Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Multicluster Engine for Kubernetes
OpenShift Pipelines
OpenShift Serverless
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift for Windows Containers
Red Hat OpenShift GitOps
Red Hat OpenShift on AWS
Red Hat OpenShift Virtualization 4
Red Hat Quay 3
Red Hat Trusted Artifact Signer
Security Profiles Operator
Zero Trust Workload Identity Manager

Not affected:

RHEM 1.1 for RHEL 10
RHEM 1.1 for RHEL 9
Cluster Observability Operator 1.5.0
Logging Subsystem for Red Hat OpenShift 6.6
OpenShift API for Data Protection 1.3
OpenShift API for Data Protection 1.4
OpenShift API for Data Protection 1.5
OpenShift API for Data Protection 1.6
Red Hat Advanced Cluster Management for Kubernetes 2.16
Red Hat Advanced Cluster Security 4.9

Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67450 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:61314

Package advisory (CVE-2026-39831)

Affected packages:

golang.org/x/crypto < 0.52.0

Patched in:

golang.org/x/crypto 0.52.0

Source: https://osv.dev/vulnerability/GO-2026-5019

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS 9.1 → 8.1
Sep 8, 2026Severity critical → high
Sep 8, 2026CVSS 8.1 → 9.1
Sep 8, 2026Severity high → critical
Sep 8, 2026CVSS 9.1 → 8.1
Sep 8, 2026Severity critical → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go#ghsa

← Back to feed