KnownHosts Revocation Check Failure in golang.org/x/crypto/ssh<0.52.0
CVE-2026-42508 Published on May 22, 2026

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

NVD

Vulnerability Analysis

CVE-2026-42508 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.

Products Associated with CVE-2026-42508

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-42508 are published in these products:

Canonical Ubuntu Linux

Red Hat Hummingbird

Red Hat Assisted Installer

Red Hat Openshift Builds

Red Hat External Secrets Operator

Red Hat Multicluster Engine

Red Hat Openshift Api Data Protection

Red Hat Serverless

Red Hat Acm

Red Hat Advanced Cluster Security

Red Hat Ceph Storage

Red Hat Edge Manager

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Ai

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Devworkspace

Red Hat Openshift Gitops

Red Hat Container Native Virtualization

Red Hat Openstack

Red Hat Quay

Red Hat Trusted Artifact Signer

Affected Versions

golang.org/x/crypto/ssh/knownhosts:

Before 0.52.0 is affected.

Red Hat Enterprise Linux 10:

Version 7:5.8.2-4.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020260701102925.afee755d and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 6:5.8.2-4.el9_8 and below * is unaffected.

Red Hat RHEM 1.0 for RHEL 9:

Version 0:1.0.3-1.el9em and below * is unaffected.

Red Hat RHEM 1.1 for RHEL 10:

Version 0:1.1.3-1.el10em and below * is unaffected.

Red Hat RHEM 1.1 for RHEL 9:

Version 0:1.1.3-1.el9em and below * is unaffected.

Red Hat DevWorkspace Operator 0.42:

Version 1782401674 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1783813250 and below * is unaffected.

Red Hat Advanced Cluster Security 4.9:

Version 1781686446 and below * is unaffected.

Red Hat Advanced Cluster Security for Kubernetes 4.10:

Version 1781686458 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502025 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784196588 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126780 and below * is unaffected.

Red Hat Hardened Images:

Version 1.25.11-2.hum1 and below * is unaffected.

Red Hat Hardened Images:

Version 1.26.4-2.hum1 and below * is unaffected.

Red Hat OpenShift Builds 1.7.1:

Version 1783057868 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1784121108 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783612119 and below * is unaffected.