Skip to content
Fencer Vulns
critical 9.1

CVE-2026-42508 json

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

published 2026-05-22 5 mo ago modified 2026-09-15 55 d ago also GHSA-5cgq-3rg8-m6cv , GO-2026-5021 , EUVD-2026-31399

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
6.9%
EPSS 6.9% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

Patch / fix

  • go golang.org/x/crypto 0.52.0
  • golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts 0.52.0
  • Red Hat Red Hat Enterprise Linux 10 7:5.8.2-4.el10_2
  • Red Hat Red Hat Enterprise Linux 8 8100020260701102925.afee755d
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260803064027.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020260803064027.ad008a3a
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260721142025.63b34585
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260721142025.63b34585
  • Red Hat Red Hat Enterprise Linux 9 6:5.8.2-4.el9_8
  • Red Hat RHEM 1.0 for RHEL 9 0:1.0.3-1.el9em
  • Red Hat RHEM 1.1 for RHEL 10 0:1.1.3-1.el10em
  • Red Hat RHEM 1.1 for RHEL 9 0:1.1.3-1.el9em
  • Red Hat Cluster Observability Operator 1.5.0 1787593637
  • Red Hat DevWorkspace Operator 0.42 1782401674
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 1788439505
  • Red Hat multicluster engine for Kubernetes 2.1 1784646026
  • Red Hat multicluster engine for Kubernetes 2.11 1786911957, 1786912006
  • Red Hat multicluster engine for Kubernetes 2.8 1784646786
  • Red Hat OpenShift API for Data Protection 1.3 1785177359
  • Red Hat OpenShift API for Data Protection 1.4 1786946294
  • Red Hat OpenShift API for Data Protection 1.5 1788859896
  • Red Hat OpenShift API for Data Protection 1.6 1784058822
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 1783813250
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1784740143
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1786456658
  • Red Hat Red Hat Advanced Cluster Security 4.9 1781686446
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1781686458
  • Red Hat Red Hat Edge Manager 1.0 1783502025
  • Red Hat Red Hat Edge Manager 1.1 1784126780, 1784196588
  • Red Hat Red Hat Hardened Images 1.25.11-2.hum1, 1.26.4-2.hum1
  • golang-go.crypto Debian 14 1:0.52.0-1

debian advisories DEBIAN-CVE-2026-42508

  • lxd Ubuntu Pro 16.04 LTS 2.0.11-0ubuntu1~16.04.4+esm3
  • lxd Ubuntu Pro 18.04 LTS 3.0.3-0ubuntu1~18.04.2+esm3
  • golang-go.crypto Ubuntu Pro 18.04 LTS 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2
  • golang-go.crypto Ubuntu Pro 20.04 LTS 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2
  • golang-go.crypto Ubuntu Pro 22.04 LTS 1:0.0~git20211202.5770296-1ubuntu0.1~esm2
  • golang-go.crypto Ubuntu Pro 24.04 LTS 1:0.19.0-1ubuntu0.1~esm2
  • golang-go.crypto Ubuntu Pro 26.04 LTS 1:0.47.0-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-42508

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • flightctl edge manager 1.1 1.1.3-1.el10em
  • flightctl edge manager 1.1 1.1.3-1.el9em
  • flightctl-cli edge manager 1.1 1.1.3-1.el10em
  • flightctl-cli edge manager 1.1 1.1.3-1.el9em
  • flightctl-agent edge manager 1.1 1.1.3-1.el10em
  • flightctl-agent edge manager 1.1 1.1.3-1.el9em
  • podman RHEL 9 6:5.8.2-4.el9_8
  • podman-tests RHEL 9 6:5.8.2-4.el9_8

red hat advisories RHSA-2026:67450RHSA-2026:51288RHSA-2026:49944RHSA-2026:41019RHSA-2026:37123RHSA-2026:37072

  • podman Linux Micro 6.1 5.4.2-slfo.1.1_6.1
  • distribution SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.1-150400.9.41.1
  • containerized-data-importer SLE Module for Containers 15 SP7 1.64.0-150700.9.14.1
  • govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
  • kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.30.1
  • terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
  • terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
  • terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1

suse advisories SUSE-SU-2026:24378-1SUSE-SU-2026:4212-1SUSE-SU-2026:4209-1SUSE-SU-2026:23625-1SUSE-SU-2026:3203-1SUSE-SU-2026:3056-1

  • cloudflared openSUSE Leap 16.0 2026.9.1-bp160.1.1
  • containerized-data-importer1.65 openSUSE Leap 16.0 1.65.0-160000.3.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
  • glab openSUSE Leap 16.0 1.114.0-bp160.1.1
  • kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
  • containerized-data-importer1.66 openSUSE Tumbleweed 1.66.0-1.1
  • kubevirt1.9 openSUSE Tumbleweed 1.9.0-1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21924-1openSUSE-SU-2026:21824-1openSUSE-SU-2026:21761-1openSUSE-SU-2026:21662-1openSUSE-SU-2026:21590-1openSUSE-SU-2026:11514-1

  • podman AlmaLinux 9 6:5.8.2-4.el9_8
  • podman-tests AlmaLinux 9 6:5.8.2-4.el9_8
  • podman-docker AlmaLinux 9 6:5.8.2-4.el9_8
  • podman-remote AlmaLinux 9 6:5.8.2-4.el9_8
  • podman-plugins AlmaLinux 9 6:5.8.2-4.el9_8
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+4047+545787c4
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3901+4b80ecd7
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+4120+03ad4b47

almalinux advisories ALSA-2026:37123ALSA-2026:35833

  • podman Rocky Linux 10 7:5.8.2-4.el10_2
  • podman Rocky Linux 9 6:5.8.2-4.el9_8
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1874+ce489889
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+40047+0c0a73f4
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+40133+32c21f88
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1843+6892ab28
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1948+4b5cd4a9
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1872+2e18eb19

rocky linux advisories RLSA-2026:37072RLSA-2026:37123RLSA-2026:35833

  • packer Azure Linux 3.0 1.9.5-15
  • telegraf Azure Linux 3.0 1.31.0-22

azure linux advisories AZL-88188AZL-88359

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42508 updated cvss 7.4

golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey

  • Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-results-api-rhel9, openshift-pipelines/pipelines-results-watcher-rhel9, openshift-pipelines/pipelines-chains-controller-rhel9, openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9, openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat Enterprise Linux 9 gvisor-tap-vsock, gvisor-tap-vsock-gvforwarder Red Hat Enterprise Linux 10 gvisor-tap-vsock Red Hat Enterprise Linux AI (RHEL AI) 3 golang Red Hat OpenShift AI (RHOAI) rhoai/odh-rhel9-operator, rhoai/odh-must-gather-rhel9, rhoai/odh-feature-server-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-kube-auth-proxy-rhel9, rhoai/odh-mlflow-operator-rhel9, +4 more
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 podman, microshift, podman-tests, podman-docker, podman-remote, microshift-olm, +23 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 5 cri-o, microshift, ose-azure-acr-image-credential-provider
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 kubevirt Red Hat Quay 3 quay/quay-builder-rhel8, quay/quay-builder-rhel9 Red Hat Trusted Artifact Signer rhtas/ec-rhel9
    affected: workaround, no fix available
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82322
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/cluster-observability-rhel9-operator 1787593637
    fixed: vendor fix RHSA-2026:61314
  • Red Hat DevWorkspace Operator 0.42 devworkspace/devworkspace-rhel9-operator 1782401674
    fixed: vendor fix RHSA-2026:36808
show 25 more
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/cluster-logging-rhel9-operator 1789659166
    fixed: vendor fix RHSA-2026:70870
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/cluster-logging-rhel9-operator 1788439505
    fixed: vendor fix RHSA-2026:66521
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/cluster-image-set-controller-rhel9 1784646786
    fixed: vendor fix RHSA-2026:47735
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/cluster-image-set-controller-rhel9 1784646026
    fixed: vendor fix RHSA-2026:46885
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hypershift-addon-rhel9-operator 1786912006, multicluster-engine/cluster-image-set-controller-rhel9 1786911957
    fixed: vendor fix RHSA-2026:57194
  • Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-mustgather-rhel9 1785177359
    fixed: vendor fix RHSA-2026:51033
  • Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-mustgather-rhel9 1786946294
    fixed: vendor fix RHSA-2026:59467
  • Red Hat OpenShift API for Data Protection 1.5 oadp/oadp-mustgather-rhel9 1788859896
    fixed: vendor fix RHSA-2026:66022
  • Red Hat OpenShift API for Data Protection 1.6 oadp/oadp-velero-rhel9 1784058822
    fixed: vendor fix RHSA-2026:43692
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/multicluster-operators-subscription-rhel9 1783813250
    fixed: vendor fix RHSA-2026:41064
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/multicluster-operators-subscription-rhel9 1784740143
    fixed: vendor fix RHSA-2026:47737
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/volsync-rhel9 1786456658
    fixed: vendor fix RHSA-2026:54400
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1781686446
    fixed: vendor fix RHSA-2026:26546
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1781686458
    fixed: vendor fix RHSA-2026:26547
  • Red Hat Edge Manager 1.0 rhem/flightctl-api-rhel9 1783502025
    fixed: vendor fix RHSA-2026:36651
  • Red Hat Edge Manager 1.1 rhem/flightctl-api-rhel9 1784126780, rhem/flightctl-api-rhel10 1784196588
    fixed: vendor fix RHSA-2026:40945
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+24482+e50f4e4f, criu 3.18-5.module+el8.10.0+24482+e50f4e4f, runc 1.2.9-4.module+el8.10.0+24482+e50f4e4f, crun 1.14.3-2.module+el8.10.0+24482+e50f4e4f, udica 0.2.6-21.module+el8.10.0+24482+e50f4e4f, conmon 2.1.10-1.module+el8.10.0+24482+e50f4e4f, +27 more
    fixed: vendor fix RHSA-2026:35833
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.8.2-4.el9_8, podman-tests 5.8.2-4.el9_8, podman-docker 5.8.2-4.el9_8, podman-remote 5.8.2-4.el9_8, podman-plugins 5.8.2-4.el9_8
    fixed: vendor fix RHSA-2026:37123
  • Red Hat Enterprise Linux AppStream (v. 10) podman 5.8.2-4.el10_2, podman-docker 5.8.2-4.el10_2, podman-remote 5.8.2-4.el10_2
    fixed: vendor fix RHSA-2026:37072
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) crit 3.15-3.module+el8.6.0+24209+25a14987, criu 3.15-3.module+el8.6.0+24209+25a14987, crun 1.14.3-1.module+el8.6.0+24209+25a14987, udica 0.2.6-5.module+el8.6.0+24209+25a14987, conmon 2.1.4-1.module+el8.6.0+24209+25a14987, runc 1.2.9-1.module+el8.6.0+24505+50d764bf.2, +27 more
    fixed: vendor fix RHSA-2026:51288
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) crit 3.15-4.module+el8.8.0+23884+2031fc78, criu 3.15-4.module+el8.8.0+23884+2031fc78, crun 1.14.3-1.module+el8.8.0+23884+2031fc78, conmon 2.1.6-1.module+el8.8.0+23884+2031fc78, runc 1.2.9-1.module+el8.8.0+24525+a924b82f.1, udica 0.2.6-20.module+el8.8.0+23884+2031fc78, +27 more
    fixed: vendor fix RHSA-2026:49944
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) podman 5.4.0-22.el9_6.5, podman-tests 5.4.0-22.el9_6.5, podman-docker 5.4.0-22.el9_6.5, podman-remote 5.4.0-22.el9_6.5, podman-plugins 5.4.0-22.el9_6.5
    fixed: vendor fix RHSA-2026:67450
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) crit 3.15-3.module+el8.6.0+24209+25a14987, criu 3.15-3.module+el8.6.0+24209+25a14987, crun 1.14.3-1.module+el8.6.0+24209+25a14987, udica 0.2.6-5.module+el8.6.0+24209+25a14987, conmon 2.1.4-1.module+el8.6.0+24209+25a14987, runc 1.2.9-1.module+el8.6.0+24505+50d764bf.2, +27 more
    fixed: vendor fix RHSA-2026:51288
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) crit 3.15-4.module+el8.8.0+23884+2031fc78, criu 3.15-4.module+el8.8.0+23884+2031fc78, crun 1.14.3-1.module+el8.8.0+23884+2031fc78, conmon 2.1.6-1.module+el8.8.0+23884+2031fc78, runc 1.2.9-1.module+el8.8.0+24525+a924b82f.1, udica 0.2.6-20.module+el8.8.0+23884+2031fc78, +27 more
    fixed: vendor fix RHSA-2026:49944
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests 5.8.2-4.el10_2
    fixed: vendor fix RHSA-2026:37072

20 more fixed, 48 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
5 mo ago

Exploit prediction

6.91% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go golang.org/x/crypto
<0.52.0
0.52.0

Affected products

  • golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat RHEM 1.0 for RHEL 9
  • Red Hat RHEM 1.1 for RHEL 10
  • Red Hat RHEM 1.1 for RHEL 9
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat DevWorkspace Operator 0.42
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat OpenShift API for Data Protection 1.3
  • Red Hat OpenShift API for Data Protection 1.4
  • Red Hat OpenShift API for Data Protection 1.5
  • Red Hat OpenShift API for Data Protection 1.6
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Edge Manager 1.0
  • Red Hat Red Hat Edge Manager 1.1
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift Builds 1.7.3
  • Red Hat Red Hat OpenShift Builds 1.8.1
  • Red Hat Red Hat Openshift Data Foundation 4.22
  • Red Hat Red Hat OpenShift GitOps 1.19
  • Red Hat Red Hat OpenShift GitOps 1.20
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Trusted Artifact Signer 1.4
  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2
  • Red Hat cert-manager Operator for Red Hat OpenShift
  • Red Hat ExternalDNS Operator
  • Red Hat External Secrets Operator for Red Hat OpenShift
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.