Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
Summary
| CVE | CVE-2026-39828 |
|---|---|
| State | PUBLISHED |
| Assigner | Go |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-22 04:16:22 UTC |
| Updated | 2026-07-13 13:16:35 UTC |
| Description | When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. |
Risk And Classification
Primary CVSS: v3.1 6.3 MEDIUM from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.003140000 probability, percentile 0.233300000 (date 2026-07-12)
Problem Types: CWE-295 | CWE-281 | CWE-863: Incorrect Authorization | CWE-281 Improper Preservation of Permissions
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 6.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| 3.1 | ADP | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| groups.google.com/g/golang-announce/c/a082jnz-LvI | [email protected] | groups.google.com | Mailing List |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36797 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37278 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37272 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36651 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36808 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/cl/781621 | [email protected] | go.dev | Issue Tracking |
| access.redhat.com/errata/RHSA-2026:37387 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26546 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37268 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36207 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26547 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36319 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37296 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| go.dev/issue/79562 | [email protected] | go.dev | Issue Tracking |
| access.redhat.com/errata/RHSA-2026:36167 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37271 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36105 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36625 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36648 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| pkg.go.dev/vuln/GO-2026-5014 | [email protected] | pkg.go.dev | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:36796 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37286 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-39828 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: NCC Group Cryptography Services, sponsored by Teleport (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-05-22T04:01:46.775Z | Reported to Red Hat. |
| ADP | 2026-05-22T02:31:26.883Z | Made public. |
Solutions
ADP: RHSA-2026:36796: RHEM 1.0 for RHEL 9
ADP: RHSA-2026:36808: DevWorkspace Operator 0.42
ADP: RHSA-2026:26547: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11
ADP: RHSA-2026:26546: Red Hat Advanced Cluster Security for Kubernetes 4.9
ADP: RHSA-2026:36319: Red Hat Advanced Cluster Security for Kubernetes 4.9
ADP: RHSA-2026:36651: Red Hat Edge Manager 1.0
ADP: RHSA-2026:36648: Red Hat OpenShift Builds 1.7.4
ADP: RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22
ADP: RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37271: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37268: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37278: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37286: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:37296: Red Hat Trusted Artifact Signer 1.4
ADP: RHSA-2026:36105: multicluster engine for Kubernetes 2.6
ADP: RHSA-2026:36167: multicluster engine for Kubernetes 2.6
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.