Description
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Metrics
CVSS 3.1 6.3/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| golang.org/x/crypto | golang.org/x/crypto/ssh | < 0.52.0 |
| Red Hat | Cryostat 4 on RHEL 9 | — |
| Red Hat | RHEM 1.0 for RHEL 9 | — |
| Red Hat | RHEM 1.1 for RHEL 10 | — |
| Red Hat | RHEM 1.1 for RHEL 9 | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.19 | — |
| Red Hat | DevWorkspace Operator 0.42 | — |
| Red Hat | DevWorkspace Operator 0.42 | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.1 | — |
| Red Hat | multicluster engine for Kubernetes 2.11 | — |
| Red Hat | multicluster engine for Kubernetes 2.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.8 | — |
| Red Hat | OpenShift API for Data Protection 1.3 | — |
| Red Hat | OpenShift API for Data Protection 1.3 | — |
| Red Hat | OpenShift API for Data Protection 1.3 | — |
| Red Hat | OpenShift API for Data Protection 1.4 | — |
| Red Hat | OpenShift API for Data Protection 1.4 | — |
| Red Hat | OpenShift API for Data Protection 1.4 | — |
| Red Hat | OpenShift API for Data Protection 1.5 | — |
| Red Hat | OpenShift API for Data Protection 1.5 | — |
| Red Hat | OpenShift API for Data Protection 1.6 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.11 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.0 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
| Red Hat | Red Hat Edge Manager 1.1 | — |
References
- https://go.dev/cl/781621Issue Tracking
- https://go.dev/issue/79562Issue Tracking
- https://groups.google.com/g/golang-announce/c/a082jnz-LvIMailing List
- https://pkg.go.dev/vuln/GO-2026-5014Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:26546
- https://access.redhat.com/errata/RHSA-2026:26547
- https://access.redhat.com/errata/RHSA-2026:36105
- https://access.redhat.com/errata/RHSA-2026:36167
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:36808
- https://access.redhat.com/errata/RHSA-2026:37268
- https://access.redhat.com/errata/RHSA-2026:37271
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:37278
- https://access.redhat.com/errata/RHSA-2026:37286
- https://access.redhat.com/errata/RHSA-2026:37296
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40969
- https://access.redhat.com/errata/RHSA-2026:40972
- https://access.redhat.com/errata/RHSA-2026:40974
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:41055
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:46885
- https://access.redhat.com/errata/RHSA-2026:46903
- https://access.redhat.com/errata/RHSA-2026:47735
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:51033
- https://access.redhat.com/errata/RHSA-2026:51038
- https://access.redhat.com/errata/RHSA-2026:52857
- https://access.redhat.com/errata/RHSA-2026:52910
- https://access.redhat.com/errata/RHSA-2026:54531
- https://access.redhat.com/errata/RHSA-2026:57191
- https://access.redhat.com/errata/RHSA-2026:57194
- https://access.redhat.com/errata/RHSA-2026:59467
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:66022
- https://access.redhat.com/errata/RHSA-2026:66521
- https://access.redhat.com/security/cve/CVE-2026-39828
- https://bugzilla.redhat.com/show_bug.cgi?id=2480687
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json
Timeline
- Published
- May 22, 2026
- Last modified
- Sep 11, 2026
- NVD status
- Modified