8.8

CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Golang ≫ Crypto SwPlatformgo Version < 0.52.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.294
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://go.dev/issue/79562
Issue Tracking
https://go.dev/cl/781621
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2480687
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
Mailing List
https://pkg.go.dev/vuln/GO-2026-5014
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26546
https://access.redhat.com/errata/RHSA-2026:26547
https://access.redhat.com/errata/RHSA-2026:36167
https://access.redhat.com/security/cve/CVE-2026-39828
https://access.redhat.com/errata/RHSA-2026:36319
https://access.redhat.com/errata/RHSA-2026:36207
https://access.redhat.com/errata/RHSA-2026:36625
https://access.redhat.com/errata/RHSA-2026:36648
https://access.redhat.com/errata/RHSA-2026:36105
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36796
https://access.redhat.com/errata/RHSA-2026:36797
https://access.redhat.com/errata/RHSA-2026:37271
https://access.redhat.com/errata/RHSA-2026:36808
https://access.redhat.com/errata/RHSA-2026:37268
https://access.redhat.com/errata/RHSA-2026:37387
https://access.redhat.com/errata/RHSA-2026:37272
https://access.redhat.com/errata/RHSA-2026:37278
https://access.redhat.com/errata/RHSA-2026:37286
https://access.redhat.com/errata/RHSA-2026:37296
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40974
https://access.redhat.com/errata/RHSA-2026:40969
https://access.redhat.com/errata/RHSA-2026:41036
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:41019
https://access.redhat.com/errata/RHSA-2026:40972
https://access.redhat.com/errata/RHSA-2026:41055
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42796
https://access.redhat.com/errata/RHSA-2026:43052
https://access.redhat.com/errata/RHSA-2026:43692
https://access.redhat.com/errata/RHSA-2026:46885
https://access.redhat.com/errata/RHSA-2026:46903
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:48151
https://access.redhat.com/errata/RHSA-2026:51033
https://access.redhat.com/errata/RHSA-2026:52857
https://access.redhat.com/errata/RHSA-2026:51038
https://access.redhat.com/errata/RHSA-2026:52910
https://access.redhat.com/errata/RHSA-2026:54531
https://access.redhat.com/errata/RHSA-2026:57191
https://access.redhat.com/errata/RHSA-2026:57194