Bug 2480687 (CVE-2026-39828)

Summary:	CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, akoudelk, alcohan, amctagga, anjoseph, aoconnor, aruklets, bdettelb, bniver, cmah, crizzo, dakwon, dhanak, dkeler, doconnor, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, fdeutsch, flucifre, gmeno, gparvin, groman, jaharrin, jbalunas, jburrell, jeder, jjoyce, jkoehler, jmatthew, jolong, jprabhak, jpretori, jschluet, kingland, kverlaen, lball, lbragsta, lgamliel, lhh, lphiri, manissin, mbenjamin, mburns, mgarciac, mhackett, mnovotny, ngough, oramraz, pahickey, pjindal, rekumar, rfreiman, rhaigner, rhel-process-autobot, rjohnson, sausingh, sbratsla, sdawley, smullick, sostapov, stirabos, suppawar, thason, vereddy, veshanka, vkarehfa, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xiyuan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2489873, 2489875, 2489876, 2489879, 2489880, 2489882, 2489883, 2489886, 2489887, 2489888, 2489889, 2489890, 2489891, 2489892, 2489893, 2489894, 2489897, 2489898, 2489899, 2489900, 2489901, 2489902, 2489903, 2489904, 2489906, 2489907, 2489908, 2489909, 2489910, 2489911, 2489912, 2489914, 2489915, 2489917, 2489920, 2489921, 2489922, 2489923, 2489924, 2489925, 2489926, 2489927, 2489929, 2489933, 2489934, 2489935, 2489936, 2489937, 2489940, 2489942, 2489943, 2489944, 2489946, 2489947, 2489949, 2489951, 2489952, 2489954, 2489956, 2489957, 2489958, 2489959, 2489963, 2489964, 2489965, 2489966, 2489874, 2489877, 2489878, 2489881, 2489884, 2489885, 2489895, 2489896, 2489905, 2489913, 2489916, 2489918, 2489919, 2489928, 2489930, 2489931, 2489932, 2489938, 2489939, 2489941, 2489945, 2489948, 2489950, 2489953, 2489955, 2489960, 2489961, 2489962
Bug Blocks:

Description OSIDB Bzimport 2026-05-22 04:02:09 UTC

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Comment 2 errata-xmlrpc 2026-07-08 15:51:12 UTC

This issue has been addressed in the following products:

  RHEM 1.0 for RHEL 9

Via RHSA-2026:36796 https://access.redhat.com/errata/RHSA-2026:36796