--- id: CVE-2026-46595 title: >- golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595) summary: >- A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This… severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L' cvssSource: vendor cwe: - CWE-303 - CWE-863 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - confidential_compute_attestation - external_secrets_operator_for_red_hat_openshift - multicluster_engine_for_kubernetes - openshift_pipelines - openshift_serverless - advanced_cluster_management_for_kubernetes 2 - ceph_storage 9 - enterprise_linux 10 - enterprise_linux 9 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_for_windows_containers - openshift_gitops - openshift_on_aws - openshift_virtualization 4 - quay 3 - security_profiles_operator - zero_trust_workload_identity_manager - zero_trust_workload_identity_manager_tech_preview - rhem_1_1_for_rhel 10 - cryostat_4_on_rhel 9 - rhem_1_0_for_rhel 9 - rhem_1_1_for_rhel 9 - cert_manager_support_for_red_hat_openshift_release 1.19 - cluster_observability_operator 1.5.0 - devworkspace_operator 0.42 - logging_subsystem_for_red_hat_openshift 6.5 - logging_subsystem_for_red_hat_openshift 6.6 - openshift_api_for_data_protection 1.3 - openshift_api_for_data_protection 1.4 - openshift_api_for_data_protection 1.5 - openshift_api_for_data_protection 1.6 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_security 4.9 - advanced_cluster_security_for_kubernetes 4.10 - advanced_cluster_security_for_kubernetes 4.11 - edge_manager 1.0 - edge_manager 1.1 patched: - rhem_1_1_for_rhel 10 - cryostat_4_on_rhel 9 - rhem_1_0_for_rhel 9 - rhem_1_1_for_rhel 9 - cert_manager_support_for_red_hat_openshift_release 1.19 - cluster_observability_operator 1.5.0 - devworkspace_operator 0.42 - logging_subsystem_for_red_hat_openshift 6.5 - logging_subsystem_for_red_hat_openshift 6.6 - openshift_api_for_data_protection 1.3 - openshift_api_for_data_protection 1.4 - openshift_api_for_data_protection 1.5 - openshift_api_for_data_protection 1.6 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_security 4.9 - advanced_cluster_security_for_kubernetes 4.10 - advanced_cluster_security_for_kubernetes 4.11 - edge_manager 1.0 - edge_manager 1.1 - enterprise_linux_ai 3.4 - hardened_images - openshift_ai 3.3 - openshift_ai 3.4 - openshift_builds 1.7.3 - openshift_builds 1.8.1 - openshift_dev_spaces 3.29 - openshift_data_foundation 4.22 - quay 3.14 - quay 3.15 - trusted_artifact_signer 1.4 - multicluster_engine_for_kubernetes 2.8 published: '2026-05-22' updated: '2026-09-23' sourceUpdated: '2026-09-23T21:51:41+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json - url: 'https://access.redhat.com/security/cve/CVE-2026-46595' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2480689' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-46595' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46595' - url: 'https://go.dev/cl/781642' - url: 'https://go.dev/issue/79570' - url: 'https://groups.google.com/g/golang-announce/c/a082jnz-LvI' - url: 'https://pkg.go.dev/vuln/GO-2026-5023' - url: 'https://access.redhat.com/errata/RHSA-2026:41019' - url: 'https://access.redhat.com/errata/RHSA-2026:48151' - url: 'https://access.redhat.com/errata/RHSA-2026:36796' - url: 'https://access.redhat.com/errata/RHSA-2026:54531' - url: 'https://access.redhat.com/errata/RHSA-2026:61314' - url: 'https://access.redhat.com/errata/RHSA-2026:36808' - url: 'https://access.redhat.com/errata/RHSA-2026:70870' - url: 'https://access.redhat.com/errata/RHSA-2026:66521' - url: 'https://access.redhat.com/errata/RHSA-2026:51033' - url: 'https://access.redhat.com/errata/RHSA-2026:59467' - url: 'https://access.redhat.com/errata/RHSA-2026:66022' - url: 'https://access.redhat.com/errata/RHSA-2026:43692' - url: 'https://access.redhat.com/errata/RHSA-2026:30651' - url: 'https://access.redhat.com/errata/RHSA-2026:47737' - url: 'https://access.redhat.com/errata/RHSA-2026:26546' - url: 'https://access.redhat.com/errata/RHSA-2026:26547' - url: 'https://access.redhat.com/errata/RHSA-2026:36207' - url: 'https://access.redhat.com/errata/RHSA-2026:36651' - url: 'https://access.redhat.com/errata/RHSA-2026:40945' - url: 'https://access.redhat.com/errata/RHSA-2026:40118' - url: 'https://access.redhat.com/errata/RHSA-2026:33531' - url: 'https://access.redhat.com/errata/RHSA-2026:33524' - url: 'https://access.redhat.com/errata/RHSA-2026:23262' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23264' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30650' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36648' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36797' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36820' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:37275' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:37387' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:41036' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42796' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:59558' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60520' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-45337' - url: 'https://github.com/advisories/GHSA-x527-x647-q7gg' tags: - csaf - vex - red-hat - cve.org - nvd - ghsa - go - score-dispute epss: 0.00602 epssPercentile: 0.46479 ecosystem: go ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-05-22T18:21:12.222019Z' scores: vendor: 7.1 adp: 10 nvd: 10 ingestedAt: '2026-06-26T16:43:14.191Z' --- ## Overview A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix. ## Vendor advisories - **RHSA-2026:41019** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41019) - **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151) - **RHSA-2026:36796** · Red Hat · fixed in: RHEM 1.0 for RHEL 9 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36796) - **RHSA-2026:54531** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54531) - **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314) - **RHSA-2026:36808** · Red Hat · fixed in: DevWorkspace Operator 0.42 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36808) - **RHSA-2026:70870** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70870) - **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521) - **RHSA-2026:51033** · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51033) - **RHSA-2026:59467** · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59467) - **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022) - **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Multicluster Engine for Kubernetes, OpenShift Pipelines, OpenShift Serverless, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Container Platform 4, … · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json) - **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692) - **RHSA-2026:30651** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-06-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:30651) - **RHSA-2026:47737** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47737) **golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation** — rated Important by Red Hat. Released 2026-05-22, updated 2026-09-23. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Confidential Compute Attestation - External Secrets Operator for Red Hat OpenShift - Multicluster Engine for Kubernetes - OpenShift Pipelines - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Ceph Storage 9 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift for Windows Containers - Red Hat OpenShift GitOps - Red Hat OpenShift on AWS - Red Hat OpenShift Virtualization 4 - Red Hat Quay 3 - Security Profiles Operator - Zero Trust Workload Identity Manager - Zero Trust Workload Identity Manager - Tech Preview Fixed: - RHEM 1.1 for RHEL 10 - Cryostat 4 on RHEL 9 - RHEM 1.0 for RHEL 9 - RHEM 1.1 for RHEL 9 - Cert Manager support for Red Hat OpenShift release 1.19 - Cluster Observability Operator 1.5.0 - DevWorkspace Operator 0.42 - Logging Subsystem for Red Hat OpenShift 6.5 - Logging Subsystem for Red Hat OpenShift 6.6 - OpenShift API for Data Protection 1.3 - OpenShift API for Data Protection 1.4 - OpenShift API for Data Protection 1.5 - OpenShift API for Data Protection 1.6 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Security 4.9 - Red Hat Advanced Cluster Security for Kubernetes 4.10 - Red Hat Advanced Cluster Security for Kubernetes 4.11 - Red Hat Edge Manager 1.0 - Red Hat Edge Manager 1.1 - Red Hat Enterprise Linux AI 3.4 - Red Hat Hardened Images - Red Hat OpenShift AI 3.3 - Red Hat OpenShift AI 3.4 - Red Hat OpenShift Builds 1.7.3 - Red Hat OpenShift Builds 1.8.1 - Red Hat OpenShift Dev Spaces 3.29 - Red Hat Openshift Data Foundation 4.22 - Red Hat Quay 3.14 - Red Hat Quay 3.15 - Red Hat Trusted Artifact Signer 1.4 - multicluster engine for Kubernetes 2.8 No fix planned: - Confidential Compute Attestation - External Secrets Operator for Red Hat OpenShift - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift Container Platform 4 - Zero Trust Workload Identity Manager - Zero Trust Workload Identity Manager - Tech Preview - Red Hat Ceph Storage 9 - Assisted Installer for Red Hat OpenShift Container Platform 2 - Multicluster Engine for Kubernetes - OpenShift Pipelines - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 9 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift for Windows Containers - Red Hat OpenShift GitOps - Red Hat OpenShift on AWS - Red Hat OpenShift Virtualization 4 - Red Hat Quay 3 - Security Profiles Operator Not affected: - RHEM 1.1 for RHEL 10 - Cryostat 4 on RHEL 9 - RHEM 1.0 for RHEL 9 - RHEM 1.1 for RHEL 9 - Cert Manager support for Red Hat OpenShift release 1.19 - Cluster Observability Operator 1.5.0 - DevWorkspace Operator 0.42 - Logging Subsystem for Red Hat OpenShift 6.5 - Logging Subsystem for Red Hat OpenShift 6.6 - OpenShift API for Data Protection 1.3 ## Remediation See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:41019 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:48151 See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.0 https://access.redhat.com/errata/RHSA-2026:36796 ## Package advisory (CVE-2026-46595) Affected packages: - `golang.org/x/crypto/ssh < 0.52.0` Patched in: - `golang.org/x/crypto/ssh 0.52.0` Source: https://github.com/advisories/GHSA-x527-x647-q7gg