CVE-2026-42508
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
- State
- Published
- Severity
- 9.1 Critical
- Published
- May 22, 2026
- Updated
- Sep 15, 2026
- Reserved
- Apr 28, 2026
Description
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | redhat-SADP |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
golang.org/x/crypto/ssh/knownhostsgolang.org/x/crypto |
|
References
- https://go.dev/issue/79568
- https://go.dev/cl/781220
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5021
- https://access.redhat.com/security/cve/CVE-2026-42508vdb-entry
- RHBZ#2480688issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json
- https://access.redhat.com/errata/RHSA-2026:41019vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36796vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:37072vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:35833vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:51288vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:49944vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:67450vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:37123vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:61314vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36808vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:66521vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:51033vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:59467vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:66022vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:43692vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41064vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:47737vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:54400vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26546vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26547vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36651vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:40945vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:40118vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:23262vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:23264vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:65126vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:60520vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36648vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41036vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:52857vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:52910vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:37387vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41031vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:42146vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:43052vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:42796vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41066vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:40262vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36797vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:57194vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:46885vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:47735vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.