Bug 2480675 (CVE-2026-39831) - CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
Summary: CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key...
Keywords:
Status: NEW
Alias: CVE-2026-39831
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2509390 2509392 2509393 2509394 2509395 2509397 2509402 2509403 2509405 2509407 2509408 2509409 2509410 2509411 2509413 2509414 2509415 2509420 2509423 2509425 2509427 2509428 2509429 2509430 2509431 2509434 2509435 2509436 2509437 2509440 2509442 2509443 2509444 2509445 2509448 2509449 2509450 2509451 2509452 2509453 2509455 2509458 2509461 2509462 2509464 2509466 2509467 2509468 2509469 2509471 2509472 2509474 2509476 2509479 2509480 2509481 2509391 2509396 2509399 2509400 2509401 2509404 2509406 2509412 2509416 2509417 2509418 2509419 2509421 2509422 2509424 2509426 2509432 2509433 2509438 2509439 2509441 2509446 2509447 2509454 2509456 2509457 2509459 2509460 2509463 2509465 2509470 2509473 2509475 2509477 2509478 2509482 2509483 2509484
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-22 04:01 UTC by OSIDB Bzimport
Modified: 2026-09-16 17:20 UTC (History)
111 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:67450 0 None None None 2026-09-14 15:24:49 UTC
Red Hat Product Errata RHSA-2026:68334 0 None None None 2026-09-16 17:20:36 UTC

Description OSIDB Bzimport 2026-05-22 04:01:35 UTC 
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256, sk-ssh-ed25519) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Comment 3 Jon Orris 2026-09-14 15:24:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:67450 https://access.redhat.com/errata/RHSA-2026:67450
Comment 4 Jon Orris 2026-09-16 17:20:30 UTC 
This issue has been addressed in the following products:

  RHEM 1.1 for RHEL 10
  RHEM 1.1 for RHEL 9

Via RHSA-2026:68334 https://access.redhat.com/errata/RHSA-2026:68334
Note You need to log in before you can comment on or make changes to this bug.