CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Modified

AliasesUBUNTU-CVE-2026-42508DEBIAN-CVE-2026-42508CGA-2262-qhr2-p7mh+2837 more

Published 22-05-2026Last modified 15-09-2026

Vulnerability summary

CVE-2026-42508 is a critical (CVSS 9.1) Improper Certificate Validation vulnerability in golang crypto. EPSS estimates a 6.91% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 7% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.1/10

010

Critical · v3.1 (CVE.org)

EPSS score

6.91%

0%100%

Low · +6.26 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 73 · Related 76

OPENSUSE-SU-2026:10843-1 OPENSUSE-SU-2026:10856-1 OPENSUSE-SU-2026:10858-1 OPENSUSE-SU-2026:10889-1 OPENSUSE-SU-2026:10949-1 OPENSUSE-SU-2026:10967-1+70 more

Timeline

22-05-2026
PublishedVulnerability first disclosed.
15-09-2026
Last modifiedVulnerability information updated.

Description

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVSS metrics

7 scores · 7 sources · 1 version

v3.19.1

EPSS trend

Probability

6.91%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

Increase +6.26 pp

From 0.65% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

actions-runner-controllerAll versions (No fix recorded)
actions-runner-controller-fipsAll versions (No fix recorded)
amassAll versions (No fix recorded)
amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-fipsAll versions (No fix recorded)

amazon-cloudwatch-agent-operatorAll versions (No fix recorded)
amazon-cloudwatch-agent-operator-fipsAll versions (No fix recorded)
apache-exporterAll versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-9.3All versions (No fix recorded)
apm-server-9.4All versions (No fix recorded)
apply-cve-bump< 0.2.280-r0
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.16-r3
argo-cd-3.1-compat< 3.1.16-r3
argo-cd-3.3-compat< 3.3.14-r9
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-events< 1.9.10-r24
argo-events-fips< 1.9.10-r17
argo-workflow-controller-3.6< 3.6.19-r7
argo-workflow-executor-3.6< 3.6.19-r7
argo-workflows-3.6< 3.6.19-r7
argocd-image-updater< 1.2.1-r2
auditbeat-8.19< 8.19.16-r0
auditbeat-9.3< 9.3.5-r0
authserviceAll versions (No fix recorded)
authservice-fipsAll versions (No fix recorded)
aws-node-termination-handlerAll versions (No fix recorded)
aws-node-termination-handler-fipsAll versions (No fix recorded)
aws-otel-collectorAll versions (No fix recorded)
aws-otel-collector-fipsAll versions (No fix recorded)
azcopyAll versions (No fix recorded)
azcopy-fipsAll versions (No fix recorded)
azure-service-operatorAll versions (No fix recorded)
azure-service-operator-fipsAll versions (No fix recorded)
azuredisk-csi-1.32All versions (No fix recorded)
azuredisk-csi-1.33All versions (No fix recorded)
azuredisk-csi-1.34All versions (No fix recorded)
azuredisk-csi-fips-1.32All versions (No fix recorded)
azuredisk-csi-fips-1.33All versions (No fix recorded)
azuredisk-csi-fips-1.34All versions (No fix recorded)
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-1.33All versions (No fix recorded)
azurefile-csi-1.34All versions (No fix recorded)
azurefile-csi-1.35All versions (No fix recorded)
azurefile-csi-fips-1.32All versions (No fix recorded)
azurefile-csi-fips-1.33All versions (No fix recorded)
azurefile-csi-fips-1.34All versions (No fix recorded)
azurefile-csi-fips-1.35All versions (No fix recorded)
backup-restore-operator-10.0< 10.0.4-r3
backup-restore-operator-7.0< 7.0.8-r0
backup-restore-operator-8.1< 8.1.4-r2
backup-restore-operator-9.0< 9.0.3-r4
backup-restore-operator-fips-10.0All versions (No fix recorded)
backup-restore-operator-fips-7.0All versions (No fix recorded)
backup-restore-operator-fips-8.1All versions (No fix recorded)
backup-restore-operator-fips-9.0All versions (No fix recorded)
bank-vaults-vault-operatorAll versions (No fix recorded)
bazeliskAll versions (No fix recorded)
blob-csi-1.26All versions (No fix recorded)
blob-csi-1.27All versions (No fix recorded)
blob-csi-fips-1.26All versions (No fix recorded)
blob-csi-fips-1.27All versions (No fix recorded) | < 1.27.5-r1
blobfuse2-fipsAll versions (No fix recorded)
boring-registryAll versions (No fix recorded)
boring-registry-fipsAll versions (No fix recorded)
cadvisorAll versions (No fix recorded)
cadvisor-fipsAll versions (No fix recorded)
calico-apiserver-3.31All versions (No fix recorded)
calico-apiserver-3.32All versions (No fix recorded)
calico-apiserver-fips-3.32All versions (No fix recorded)
calico-app-policy-3.31All versions (No fix recorded)
calico-app-policy-3.32All versions (No fix recorded)
calico-app-policy-fips-3.32All versions (No fix recorded)
calico-cni-3.31All versions (No fix recorded)
calico-cni-3.32All versions (No fix recorded)
calico-cni-fips-3.32All versions (No fix recorded)
calico-felix-3.31All versions (No fix recorded)
calico-felix-3.32All versions (No fix recorded)
calico-felix-fips-3.32All versions (No fix recorded)
calico-kube-controllers-3.31All versions (No fix recorded)
calico-kube-controllers-3.32All versions (No fix recorded)
calico-kube-controllers-fips-3.32All versions (No fix recorded)
calico-node-3.31All versions (No fix recorded)
calico-node-3.32All versions (No fix recorded)
calico-node-fips-3.32All versions (No fix recorded)
calico-typhad-3.31All versions (No fix recorded)
calico-typhad-3.32All versions (No fix recorded)
calico-typhad-fips-3.32All versions (No fix recorded)
calico-whisker-backend-3.31All versions (No fix recorded)
calico-whisker-backend-3.32All versions (No fix recorded)
calico-whisker-backend-fips-3.32All versions (No fix recorded)
calicoctl-3.31All versions (No fix recorded)
calicoctl-3.32All versions (No fix recorded)
calicoctl-fips-3.32All versions (No fix recorded)
cert-manager-1.18All versions (No fix recorded)
cert-manager-cainjector-1.18All versions (No fix recorded)
cert-manager-cainjector-fips-1.18All versions (No fix recorded)
cert-manager-cainjector-fips-1.19All versions (No fix recorded)
cert-manager-cainjector-fips-1.20All versions (No fix recorded)
cert-manager-cmctlAll versions (No fix recorded)
cert-manager-cmctl-fipsAll versions (No fix recorded)
cert-manager-controller-1.18All versions (No fix recorded)
cert-manager-controller-fips-1.18All versions (No fix recorded)
cert-manager-controller-fips-1.19All versions (No fix recorded)
cert-manager-controller-fips-1.20All versions (No fix recorded)
cert-manager-csi-driverAll versions (No fix recorded)
cert-manager-csi-driver-fipsAll versions (No fix recorded)
cert-manager-fips-1.18All versions (No fix recorded)
cert-manager-fips-1.19All versions (No fix recorded)
cert-manager-fips-1.20All versions (No fix recorded)
cert-manager-google-cas-issuerAll versions (No fix recorded)
cert-manager-google-cas-issuer-fipsAll versions (No fix recorded)
cert-manager-istio-csrAll versions (No fix recorded)
cert-manager-istio-csr-fipsAll versions (No fix recorded)
cert-manager-openshift-routesAll versions (No fix recorded)
cert-manager-openshift-routes-fipsAll versions (No fix recorded)
cert-manager-startupapicheck-1.18All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.18All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.19All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.20All versions (No fix recorded)
cert-manager-webhook-1.18All versions (No fix recorded)
cert-manager-webhook-fips-1.18All versions (No fix recorded)
cert-manager-webhook-fips-1.19All versions (No fix recorded)
cert-manager-webhook-fips-1.20All versions (No fix recorded)
cert-manager-webhook-pdnsAll versions (No fix recorded)
cert-manager-webhook-pdns-fipsAll versions (No fix recorded)
certificate-transparency-fips-trillian-ctserverAll versions (No fix recorded)
certificate-transparency-trillian-ctserverAll versions (No fix recorded)
chainloop-artifact-casAll versions (No fix recorded)
chainloop-artifact-cas-fipsAll versions (No fix recorded)
chaos-meshAll versions (No fix recorded)
chaos-mesh-daemonAll versions (No fix recorded)
chaos-mesh-dashboardAll versions (No fix recorded)
chaos-mesh-fipsAll versions (No fix recorded)
chaos-mesh-fips-daemonAll versions (No fix recorded)
chaos-mesh-fips-dashboardAll versions (No fix recorded)
chartmuseumAll versions (No fix recorded)
chartmuseum-fipsAll versions (No fix recorded)
chronografAll versions (No fix recorded)
chronograf-fipsAll versions (No fix recorded)
chrony_exporterAll versions (No fix recorded)
chrony_exporter-fipsAll versions (No fix recorded)
cilium-1.16All versions (No fix recorded)
cilium-certgen-0.4All versions (No fix recorded)
cilium-certgen-fips-0.4All versions (No fix recorded)
cilium-fips-1.16All versions (No fix recorded)
cilium-fips-1.16-operator-azureAll versions (No fix recorded)
cilium-fips-1.17All versions (No fix recorded)
cilium-fips-1.17-operator-azureAll versions (No fix recorded)
cilium-fips-1.18All versions (No fix recorded)
cilium-fips-1.18-operator-azureAll versions (No fix recorded)
cilium-fips-1.19All versions (No fix recorded)
cilium-fips-1.19-operator-azureAll versions (No fix recorded)
cloud-provider-aws-1.32-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.34-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.35-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.36-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.32-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.34-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.35-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.36-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.35All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.36All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.33All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.35All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.36All versions (No fix recorded)
cloud-provider-azure-cloud-node-manager-1.35All versions (No fix recorded)
cloud-provider-azure-cloud-node-manager-1.36All versions (No fix recorded)
cloud-provider-azure-cloud-node-manager-fips-1.33All versions (No fix recorded)
cloud-provider-azure-cloud-node-manager-fips-1.35All versions (No fix recorded)
cloud-provider-azure-cloud-node-manager-fips-1.36All versions (No fix recorded)
cloud-provider-gcp-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-gcp-cloud-controller-manager-fipsAll versions (No fix recorded)
cloud-provider-vsphereAll versions (No fix recorded)
cloud-sql-proxy-2.21All versions (No fix recorded)
cloud-sql-proxy-2.22All versions (No fix recorded)
cloud-sql-proxy-fipsAll versions (No fix recorded)
cloudproberAll versions (No fix recorded)
cloudprober-fipsAll versions (No fix recorded)
cluster-api-1.12-clusterctlAll versions (No fix recorded)
commercial-chainloop-backendAll versions (No fix recorded)
commercial-chainloop-cliAll versions (No fix recorded)
commercial-expanso-edge< 2.1.19-r0
commercial-grafana-11.6< 11.6.16-r0
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2< 12.2.10-r0
commercial-grafana-12.3< 12.3.8-r0
commercial-grafana-12.4< 12.4.5-r0
commercial-kyverno-1.13All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0

Show all 200

1 vendor · 200 products · Showing 200 of 1625

References

60 links

go.dev/issue/79568REPORTWEBIssue Tracking
go.dev/cl/781220REPORTWEBFIXIssue Tracking
groups.google.com/g/golang-announce/c/a082jnz-LvIREPORTWEBMailing List
pkg.go.dev/vuln/GO-2026-5021REPORTWEBVendor Advisory
access.redhat.com/security/cve/CVE-2026-42508VDB EntryX Refsource REDHATAdvisoryWEB
bugzilla.redhat.com/show_bug.cgi?id=2480688Issue TrackingX Refsource REDHATREPORTWEB
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:41019Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:36796Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:37072Vendor AdvisoryX Refsource REDHATAdvisoryWEB

Show all 60 references

access.redhat.com/errata/RHSA-2026:35833Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:51288Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:49944Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:67450Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:37123Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:61314Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36808Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:66521Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:51033Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:59467Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:66022Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:43692Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:41064Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:47737Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:54400Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26546Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:26547Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:36651Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:40945Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:40118Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:23262Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:23264Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:65126Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:60520Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36648Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:41036Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:52857Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:52910Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:37387Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:41031Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:42146Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:43052Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:42796Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:41066Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:40262Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:36797Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2026:57194Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:46885Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:47735Vendor AdvisoryX Refsource REDHATAdvisory
ubuntu.com/security/CVE-2026-42508REPORT
www.cve.org/CVERecord?id=CVE-2026-42508REPORT
github.com/golang/crypto/commit/f717e29698a271c548239ed56bf5dd9516d6f7e8REPORT
ubuntu.com/security/notices/USN-8447-1Advisory
ubuntu.com/security/notices/USN-8447-2Advisory
security-tracker.debian.org/tracker/CVE-2026-42508Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42508.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-42508AdvisoryOval
cs.opensource.google/go/x/cryptoPACKAGE
access.redhat.com/errata/RHSA-2026:40138WEB