CVE-2026-46595
Vulnerability Summary
Timeline
Description
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
CVSS Metrics
- v3.1•CRITICAL•Score: 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
- v3.1•HIGH•Score: 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Trends
Current EPSS score: 0.50%• Percentile: 42%
Techniques & Countermeasures
- CWE-863•Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-303•Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
Affected Systems
- chainguard•aactl
< 0.4.12-r53
- chainguard•act
< 0
- chainguard•actions-runner-controller
< 0
- chainguard•actions-runner-controller-fips
< 0
- chainguard•age
< 0
- chainguard•age-fips
< 0 | < 1.3.1-r11
- chainguard•agentbeat
< 0
- chainguard•agentbeat-fips
< 0
- chainguard•amass
< 0
- chainguard•amazon-cloudwatch-agent
< 0
- chainguard•amazon-cloudwatch-agent-fips
< 0
- chainguard•amazon-cloudwatch-agent-operator
< 0
- chainguard•amazon-cloudwatch-agent-operator-fips
< 0
- chainguard•amazon-ssm-agent
< 3.3.4515.0-r2 | < 0
- chainguard•amazon-ssm-agent-ecs-exec
< 0
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 0
- chainguard•amazon-ssm-agent-fips
< 3.3.4515.0-r3 | < 0
- chainguard•apache-exporter
< 0
- chainguard•apko
< 0
- chainguard•apko-fips
< 0
- chainguard•apm-server-8.19
< 0
- chainguard•apm-server-9.1
all
- chainguard•apm-server-9.3
< 0
- chainguard•apm-server-9.4
< 0
- chainguard•apply-cve-bump
< 0
- chainguard•argo-cd-3.0
all
- chainguard•argo-cd-3.0-compat
all
- chainguard•argo-cd-3.1
< 3.1.16-r3
- chainguard•argo-cd-3.1-compat
< 3.1.16-r3
- chainguard•argo-cd-3.3-compat
< 0
- chainguard•argo-cd-3.4
< 0
- chainguard•argo-cd-3.4-compat
< 0
- chainguard•argo-cd-fips-3.0
all
- chainguard•argo-cd-fips-3.0-compat
all
- chainguard•argo-cd-fips-3.1
< 3.1.16-r1
- chainguard•argo-cd-fips-3.1-compat
< 3.1.16-r1
- chainguard•argo-cd-fips-3.2
< 3.2.12-r5
- chainguard•argo-cd-fips-3.2-compat
< 3.2.12-r5
- chainguard•argo-cd-fips-3.4
< 3.4.2-r4
- chainguard•argo-cd-fips-3.4-compat
< 3.4.2-r4
- chainguard•argo-events
< 0
- chainguard•argo-events-fips
< 0
- chainguard•argo-rollouts
< 0
- chainguard•argo-workflow-controller-3.6
< 3.6.19-r7
- chainguard•argo-workflow-controller-fips-3.6
< 3.6.19-r9
- chainguard•argo-workflow-executor-3.6
< 3.6.19-r7
- chainguard•argo-workflow-executor-fips-3.6
< 3.6.19-r9
- chainguard•argo-workflows-3.6
< 3.6.19-r7
- chainguard•argo-workflows-fips-3.6
< 3.6.19-r9
- chainguard•argocd-image-updater
< 1.2.1-r2
Showing first 50 affected entries in server-rendered view.
References (51)
- https://go.dev/issue/79570
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://go.dev/cl/781642
- https://pkg.go.dev/vuln/GO-2026-5023
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337
- https://nvd.nist.gov/vuln/detail/CVE-2026-46595
- https://cs.opensource.google/go/x/crypto
- https://access.redhat.com/security/cve/CVE-2026-46595
- https://bugzilla.redhat.com/show_bug.cgi?id=2480689
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json
- https://access.redhat.com/errata/RHSA-2026:30651
- https://access.redhat.com/errata/RHSA-2026:26547
- https://access.redhat.com/errata/RHSA-2026:26546
- https://access.redhat.com/errata/RHSA-2026:23262
- https://access.redhat.com/errata/RHSA-2026:23264
- https://access.redhat.com/errata/RHSA-2026:30650
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:33531
- https://access.redhat.com/errata/RHSA-2026:33524
- https://access.redhat.com/errata/RHSA-2026:36648
- https://access.redhat.com/errata/RHSA-2026:36796
- https://access.redhat.com/errata/RHSA-2026:36808
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:36797
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:41019
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:41036
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:51033
- https://access.redhat.com/errata/RHSA-2026:43692
- https://access.redhat.com/errata/RHSA-2026:47737
- https://security-tracker.debian.org/tracker/CVE-2026-46595
- https://access.redhat.com/errata/RHSA-2026:54531
- https://ubuntu.com/security/CVE-2026-46595
- https://www.cve.org/CVERecord?id=CVE-2026-46595
- https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce
- https://ubuntu.com/security/notices/USN-8447-1
- https://ubuntu.com/security/notices/USN-8447-3
- https://access.redhat.com/errata/RHSA-2026:59467
- https://access.redhat.com/errata/RHSA-2026:59558
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:61314
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46595.json
- https://access.redhat.com/errata/RHSA-2026:66521
- https://access.redhat.com/errata/RHSA-2026:66022