Veille CVE

Vendredi 11 septembre 2026

2 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift API for Data Protection » ✕
  1. CVE-2026-46595 10.0 Critique

    golang.org/x/crypto/ssh · Red Hat Cryostat 4 on RHEL 9 · Red Hat RHEM 1.0 for RHEL 9 · Red Hat RHEM 1.1 for RHEL 10

    Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

  2. CVE-2026-39828 6.3 Moyenne

    golang.org/x/crypto/ssh · Red Hat Cryostat 4 on RHEL 9 · Red Hat RHEM 1.0 for RHEL 9 · Red Hat RHEM 1.1 for RHEL 10

    When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.