CVE-2026-46595

CriticalCVSS 10.0/10Last modified Sep 11, 2026

Description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-863CWE-303

Affected software

VendorProductVersions
golang.org/x/cryptogolang.org/x/crypto/ssh< 0.52.0
Red HatCryostat 4 on RHEL 9—
Red HatRHEM 1.0 for RHEL 9—
Red HatRHEM 1.1 for RHEL 10—
Red HatRHEM 1.1 for RHEL 9—
Red HatCert Manager support for Red Hat OpenShift release 1.19—
Red HatCluster Observability Operator 1.5.0—
Red HatDevWorkspace Operator 0.42—
Red HatLogging Subsystem for Red Hat OpenShift 6.6—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.8—
Red HatOpenShift API for Data Protection 1.3—
Red HatOpenShift API for Data Protection 1.4—
Red HatOpenShift API for Data Protection 1.5—
Red HatOpenShift API for Data Protection 1.6—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Security 4.9—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.11—
Red HatRed Hat Edge Manager 1.0—
Red HatRed Hat Edge Manager 1.1—
Red HatRed Hat Edge Manager 1.1—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Enterprise Linux AI 3.4—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—
Red HatRed Hat OpenShift AI 3.3—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift Builds 1.7.3—
Red HatRed Hat OpenShift Builds 1.8.1—
Red HatRed Hat OpenShift Builds 1.8.1—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—
Red HatRed Hat Openshift Data Foundation 4.22—

References

Timeline

Published
May 22, 2026
Last modified
Sep 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-465977.5An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.CVE-2026-465985.3For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.CVE-2026-465997.5The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a smaCVE-2026-46607.5HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a malicioCVE-2026-466007.5Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.CVE-2026-466017.5The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.CVE-2026-466027.5The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large CVE-2026-466037.5VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unuCVE-2026-466047.5The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.CVE-2026-466054.3Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing deCVE-2026-466067.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vmsCVE-2026-466077.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-ch
CVE-2026-46595: Critical severity, CVSS 10.0 | Vulnix