by Kastro CVE-2026-46595
golang.org/x/crypto golang.org/x/crypto/ssh — Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Description · from the CVE record
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Affected
ProductAffectedFixed inSource
golang.org/x/crypto/ssh< 0.52.00.52.0CNA
Cryostat 4 on RHEL 9see advisory4.2.0-19redhat-SADP
RHEM 1.0 for RHEL 9see advisory0:1.0.3-1.el9emredhat-SADP
RHEM 1.1 for RHEL 10see advisory0:1.1.3-1.el10emredhat-SADP
RHEM 1.1 for RHEL 9see advisory0:1.1.3-1.el9emredhat-SADP
Cert Manager support for Red Hat OpenShift release 1.19see advisory1786613805redhat-SADP
Cluster Observability Operator 1.5.0see advisory1787593637redhat-SADP
DevWorkspace Operator 0.42see advisory1782401674redhat-SADP
Logging Subsystem for Red Hat OpenShift 6.6see advisory1788439505redhat-SADP
multicluster engine for Kubernetes 2.8see advisory1782160196redhat-SADP
multicluster engine for Kubernetes 2.8see advisory1782477094redhat-SADP
multicluster engine for Kubernetes 2.8see advisory1782160009redhat-SADP
Scores by source
CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
redhat-SADP (CNA)7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial