--- id: CVE-2026-39831 title: >- golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831) summary: >- A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardw… severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N' cvssSource: vendor cwe: - CWE-347 - CWE-862 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - builds_for_red_hat_openshift - cert_manager_operator_for_red_hat_openshift - confidential_compute_attestation - external_secrets_operator_for_red_hat_openshift - multicluster_engine_for_kubernetes - openshift_pipelines - openshift_serverless - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - ceph_storage 9 - edge_manager 1 - enterprise_linux 10 - enterprise_linux 8 - enterprise_linux 9 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_dev_workspaces_operator - openshift_for_windows_containers - openshift_gitops - openshift_on_aws - openshift_virtualization 4 - quay 3 - trusted_artifact_signer - security_profiles_operator - zero_trust_workload_identity_manager - zero_trust_workload_identity_manager_tech_preview - rhem_1_1_for_rhel 10 - rhem_1_1_for_rhel 9 - enterprise_linux_appstream_eus_v_9_6 - cluster_observability_operator 1.5.0 - logging_subsystem_for_red_hat_openshift 6.6 - openshift_api_for_data_protection 1.3 - openshift_api_for_data_protection 1.4 - openshift_api_for_data_protection 1.5 - openshift_api_for_data_protection 1.6 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_security 4.9 - advanced_cluster_security_for_kubernetes 4.10 - openshift_ai 3.4 patched: - rhem_1_1_for_rhel 10 - rhem_1_1_for_rhel 9 - enterprise_linux_appstream_eus_v_9_6 - cluster_observability_operator 1.5.0 - logging_subsystem_for_red_hat_openshift 6.6 - openshift_api_for_data_protection 1.3 - openshift_api_for_data_protection 1.4 - openshift_api_for_data_protection 1.5 - openshift_api_for_data_protection 1.6 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_security 4.9 - advanced_cluster_security_for_kubernetes 4.10 - openshift_ai 3.4 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 - openshift_gitops 1.19 - openshift_gitops 1.20 - openshift_data_foundation 4.22 - quay 3.10 - quay 3.15 - quay 3.16 - quay 3.9 - trusted_artifact_signer 1.3 - trusted_artifact_signer 1.4 - multicluster_engine_for_kubernetes 2.11 - multicluster_engine_for_kubernetes 2.1 - multicluster_engine_for_kubernetes 2.6 - multicluster_engine_for_kubernetes 2.8 - multicluster_engine_for_kubernetes 2.9 published: '2026-05-22' updated: '2026-09-17' sourceUpdated: '2026-09-17T11:55:44+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39831.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39831.json - url: 'https://access.redhat.com/security/cve/CVE-2026-39831' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2480675' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-39831' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39831' - url: 'https://go.dev/cl/781662' - url: 'https://go.dev/issue/79566' - url: 'https://groups.google.com/g/golang-announce/c/a082jnz-LvI' - url: 'https://pkg.go.dev/vuln/GO-2026-5019' - url: 'https://access.redhat.com/errata/RHSA-2026:68334' - url: 'https://access.redhat.com/errata/RHSA-2026:67450' - url: 'https://access.redhat.com/errata/RHSA-2026:61314' - url: 'https://access.redhat.com/errata/RHSA-2026:66521' - url: 'https://access.redhat.com/errata/RHSA-2026:51033' - url: 'https://access.redhat.com/errata/RHSA-2026:59467' - url: 'https://access.redhat.com/errata/RHSA-2026:66022' - url: 'https://access.redhat.com/errata/RHSA-2026:43692' - url: 'https://access.redhat.com/errata/RHSA-2026:54400' - url: 'https://access.redhat.com/errata/RHSA-2026:36319' - url: 'https://access.redhat.com/errata/RHSA-2026:36625' - url: 'https://access.redhat.com/errata/RHSA-2026:60520' - url: 'https://access.redhat.com/errata/RHSA-2026:57801' - url: 'https://access.redhat.com/errata/RHSA-2026:54770' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:52857' - url: 'https://access.redhat.com/errata/RHSA-2026:52910' - url: 'https://access.redhat.com/errata/RHSA-2026:37387' - url: 'https://access.redhat.com/errata/RHSA-2026:41031' - url: 'https://access.redhat.com/errata/RHSA-2026:42796' - url: 'https://access.redhat.com/errata/RHSA-2026:41066' - url: 'https://access.redhat.com/errata/RHSA-2026:40262' - url: 'https://access.redhat.com/errata/RHSA-2026:40972' - url: 'https://access.redhat.com/errata/RHSA-2026:40974' - url: 'https://access.redhat.com/errata/RHSA-2026:40969' - url: 'https://github.com/advisories/GHSA-89gr-r52h-f8rx' tags: - csaf - vex - red-hat - osv - go - ghsa epss: 0.00487 epssPercentile: 0.39272 aliases: - GO-2026-5019 - GHSA-89gr-r52h-f8rx ecosystem: go ingestedAt: '2026-06-26T16:43:14.193Z' --- ## Overview A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent. ## Vendor advisories - **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334) - **RHSA-2026:67450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67450) - **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314) - **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521) - **RHSA-2026:51033** · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51033) - **RHSA-2026:59467** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59467) - **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022) - **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692) - **RHSA-2026:54400** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54400) - **RHSA-2026:36319** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36319) - **RHSA-2026:36625** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36625) - **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Multicluster Engine for Kubernetes, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4, Zero Trust Workload Identity Manager - Tech Preview, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39831.json) - **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520) - **RHSA-2026:57801** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:57801) - **RHSA-2026:54770** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:54770) - **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260) **golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check** — rated Important by Red Hat. Released 2026-05-22, updated 2026-09-17. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - cert-manager Operator for Red Hat OpenShift - Confidential Compute Attestation - External Secrets Operator for Red Hat OpenShift - Multicluster Engine for Kubernetes - OpenShift Pipelines - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ceph Storage 9 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Workspaces Operator - Red Hat OpenShift for Windows Containers - Red Hat OpenShift GitOps - Red Hat OpenShift on AWS - Red Hat OpenShift Virtualization 4 - Red Hat Quay 3 - Red Hat Trusted Artifact Signer - Security Profiles Operator - Zero Trust Workload Identity Manager - Zero Trust Workload Identity Manager - Tech Preview Fixed: - RHEM 1.1 for RHEL 10 - RHEM 1.1 for RHEL 9 - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Cluster Observability Operator 1.5.0 - Logging Subsystem for Red Hat OpenShift 6.6 - OpenShift API for Data Protection 1.3 - OpenShift API for Data Protection 1.4 - OpenShift API for Data Protection 1.5 - OpenShift API for Data Protection 1.6 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Security 4.9 - Red Hat Advanced Cluster Security for Kubernetes 4.10 - Red Hat OpenShift AI 3.4 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Dev Spaces 3.30 - Red Hat OpenShift GitOps 1.19 - Red Hat OpenShift GitOps 1.20 - Red Hat Openshift Data Foundation 4.22 - Red Hat Quay 3.10 - Red Hat Quay 3.15 - Red Hat Quay 3.16 - Red Hat Quay 3.9 - Red Hat Trusted Artifact Signer 1.3 - Red Hat Trusted Artifact Signer 1.4 - multicluster engine for Kubernetes 2.11 - multicluster engine for Kubernetes 2.1 - multicluster engine for Kubernetes 2.6 - multicluster engine for Kubernetes 2.8 - multicluster engine for Kubernetes 2.9 No fix planned: - Confidential Compute Attestation - External Secrets Operator for Red Hat OpenShift - Red Hat OpenShift Container Platform 4 - Zero Trust Workload Identity Manager - Tech Preview - Red Hat Ceph Storage 9 - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - cert-manager Operator for Red Hat OpenShift - Multicluster Engine for Kubernetes - OpenShift Pipelines - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Dev Workspaces Operator - Red Hat OpenShift for Windows Containers - Red Hat OpenShift GitOps - Red Hat OpenShift on AWS - Red Hat OpenShift Virtualization 4 - Red Hat Quay 3 - Red Hat Trusted Artifact Signer - Security Profiles Operator - Zero Trust Workload Identity Manager Not affected: - RHEM 1.1 for RHEL 10 - RHEM 1.1 for RHEL 9 - Cluster Observability Operator 1.5.0 - Logging Subsystem for Red Hat OpenShift 6.6 - OpenShift API for Data Protection 1.3 - OpenShift API for Data Protection 1.4 - OpenShift API for Data Protection 1.5 - OpenShift API for Data Protection 1.6 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Security 4.9 ## Remediation See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67450 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:61314 ## Package advisory (CVE-2026-39831) Affected packages: - `golang.org/x/crypto < 0.52.0` Patched in: - `golang.org/x/crypto 0.52.0` Source: https://osv.dev/vulnerability/GO-2026-5019