CVE & CISA-KEV Catalog

CVE-2026-46595

CRITICAL
10.0
CVSS v3
NVD

Description

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

CWE-863Incorrect AuthorizationCWE-303

How to fix

Remediation Available
golang-go.cryptoDebian
Fixed in:1:0.52.0-1CVE-2026-46595
conforma-cli-stackRocky
Fixed in:v1-4@ppc64leRHSA-2026:50888
Fixed in:v1-4@s390xRHSA-2026:49767
Fixed in:v1-4@amd64_darwinRHSA-2026:48771
Fixed in:v1-4@arm64_darwinRHSA-2026:48771
Fixed in:v1-4@s390xRHSA-2026:36797
Fixed in:v1-4@s390xRHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:48771
Fixed in:v1-4@ppc64leRHSA-2026:36797
conforma-cli-stackRed Hat / RHEL
Fixed in:v1-4@ppc64leRHSA-2026:49767
Fixed in:v1-4@amd64RHSA-2026:37276
Fixed in:v1-4@arm64_darwinRHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:50888
Fixed in:v1-4@amd64_windowsRHSA-2026:49767
Fixed in:v1-4@s390xRHSA-2026:37276
Fixed in:v1-4@amd64_darwinRHSA-2026:37276
Fixed in:v1-4@arm64_darwinRHSA-2026:50888
cosign-cli-stackRocky
Fixed in:v1-4@amd64_darwinRHSA-2026:36797
Fixed in:v1-4@arm64_darwinRHSA-2026:48771
Fixed in:v1-4@amd64_darwinRHSA-2026:49767
Fixed in:v1-4@amd64_windowsRHSA-2026:49767
Fixed in:v1-4@s390xRHSA-2026:36797
Fixed in:v1-4@amd64RHSA-2026:48771
Fixed in:v1-4@arm64RHSA-2026:49767
Fixed in:v1-4@amd64RHSA-2026:50888
cosign-cli-stackRed Hat / RHEL
Fixed in:v1-4@amd64RHSA-2026:37276
Fixed in:v1-4@arm64_darwinRHSA-2026:36797
Fixed in:v1-4@arm64_darwinRHSA-2026:49767
Fixed in:v1-4@arm64RHSA-2026:50888
Fixed in:v1-4@ppc64leRHSA-2026:49767
Fixed in:v1-4@arm64RHSA-2026:49767
Fixed in:v1-4@amd64RHSA-2026:48771
Fixed in:v1-4@s390xRHSA-2026:49767
cryostat/cryostatRed Hat / RHEL
Fixed in:rhel9-operator@sha256:98849e3734fbdeb2252a6d4863f999ebba93155c5c650e42711c76c82b6c6b45_amd64RHSA-2026:48151
Fixed in:operator-bundle@sha256:f6f18f4a84f0a0381e5d03893d2968050537f7e20b08b61b54e922c4d9359292_arm64RHSA-2026:48151
Fixed in:reports-rhel9@sha256:b34a578607642a41719d12a902df7b4549606f37e773f6b20ed047b94c1739fe_amd64RHSA-2026:48151
Fixed in:db-rhel9@sha256:1dadbcd03e36720ff1bccd2fa77cdb7096e94322794f5ad3b8a511d08c0c30d3_amd64RHSA-2026:48151
Fixed in:rhel9@sha256:c0b028b465d8e6f3b262659195c01deee13538c1e34a823bffb7624bbb5252fc_amd64RHSA-2026:48151
Fixed in:operator-bundle@sha256:8aba4092e4ca595ee8df8f878754f698059c72d956022a1fe9e123d6ed7a7fa6_amd64RHSA-2026:48151
Fixed in:rhel9@sha256:cb6b42fb943940abf1e5c7c9f6050a7f950066497c89dd1306051697d7d207a6_arm64RHSA-2026:48151
Fixed in:storage-rhel9@sha256:a6ab21c3097a8268cba87c6eeb1f512454da0c68410031c4160c7d7378920850_arm64RHSA-2026:48151
cryostat/cryostatRocky
Fixed in:rhel9@sha256:c0b028b465d8e6f3b262659195c01deee13538c1e34a823bffb7624bbb5252fc_amd64RHSA-2026:48151
Fixed in:reports-rhel9@sha256:b34a578607642a41719d12a902df7b4549606f37e773f6b20ed047b94c1739fe_amd64RHSA-2026:48151
Fixed in:reports-rhel9@sha256:a93361b346844f7ec4108a9658cb5fdd61c8963e90ee15e52fb213b1bb4d01c6_arm64RHSA-2026:48151
Fixed in:rhel9-operator@sha256:98849e3734fbdeb2252a6d4863f999ebba93155c5c650e42711c76c82b6c6b45_amd64RHSA-2026:48151
Fixed in:operator-bundle@sha256:f6f18f4a84f0a0381e5d03893d2968050537f7e20b08b61b54e922c4d9359292_arm64RHSA-2026:48151
Fixed in:storage-rhel9@sha256:a6ab21c3097a8268cba87c6eeb1f512454da0c68410031c4160c7d7378920850_arm64RHSA-2026:48151
Fixed in:db-rhel9@sha256:1dadbcd03e36720ff1bccd2fa77cdb7096e94322794f5ad3b8a511d08c0c30d3_amd64RHSA-2026:48151
Fixed in:operator-bundle@sha256:8aba4092e4ca595ee8df8f878754f698059c72d956022a1fe9e123d6ed7a7fa6_amd64RHSA-2026:48151
cryostat/cryostat-agentRocky
Fixed in:init-rhel9@sha256:a9a7a4aff8961cea3f5a4cd5b3370c5f13105e9461f4fb0de70bcfa7b5facab1_arm64RHSA-2026:48151
Fixed in:init-rhel9@sha256:56a21c05b7e6face6abbb05a1165d02640779cda3dc829e21237840e7cbac579_amd64RHSA-2026:48151
cryostat/cryostat-agentRed Hat / RHEL
Fixed in:init-rhel9@sha256:56a21c05b7e6face6abbb05a1165d02640779cda3dc829e21237840e7cbac579_amd64RHSA-2026:48151
Fixed in:init-rhel9@sha256:a9a7a4aff8961cea3f5a4cd5b3370c5f13105e9461f4fb0de70bcfa7b5facab1_arm64RHSA-2026:48151
cryostat/cryostat-grafanaRed Hat / RHEL
Fixed in:dashboard-rhel9@sha256:ea227ce33a7d948d284c10f3f590ddfdc5058459a52b87c46ce882ac32a82a0f_amd64RHSA-2026:48151
Fixed in:dashboard-rhel9@sha256:681a38cf4bd5f892dd76e634d754106d55c1dc78ed1a59c6003fd75d8e285101_arm64RHSA-2026:48151
cryostat/cryostat-grafanaRocky
Fixed in:dashboard-rhel9@sha256:681a38cf4bd5f892dd76e634d754106d55c1dc78ed1a59c6003fd75d8e285101_arm64RHSA-2026:48151
Fixed in:dashboard-rhel9@sha256:ea227ce33a7d948d284c10f3f590ddfdc5058459a52b87c46ce882ac32a82a0f_amd64RHSA-2026:48151
cryostat/cryostat-openshift-consoleRocky
Fixed in:plugin-rhel9@sha256:c8915feceaaf08a0f3a05df8a61f44b8cfca2b23872219828a694cee047252a1_amd64RHSA-2026:48151
Fixed in:plugin-rhel9@sha256:f226753fa98b6492d7fffc0d669d1e003f5146c6214d3cbad96d0e3fd8f03663_arm64RHSA-2026:48151
cryostat/cryostat-openshift-consoleRed Hat / RHEL
Fixed in:plugin-rhel9@sha256:c8915feceaaf08a0f3a05df8a61f44b8cfca2b23872219828a694cee047252a1_amd64RHSA-2026:48151
Fixed in:plugin-rhel9@sha256:f226753fa98b6492d7fffc0d669d1e003f5146c6214d3cbad96d0e3fd8f03663_arm64RHSA-2026:48151
cryostat/jfrRed Hat / RHEL
Fixed in:datasource-rhel9@sha256:2d9c9f1cd1ff98721ea2ee56e86319bc6bc403f9b444e0fbe802ecb89b589134_amd64RHSA-2026:48151
Fixed in:datasource-rhel9@sha256:89b841456cfe46bf4d3b6bd32dea131c51241d2b1bd266d408eac78ed79c395a_arm64RHSA-2026:48151
cryostat/jfrRocky
Fixed in:datasource-rhel9@sha256:2d9c9f1cd1ff98721ea2ee56e86319bc6bc403f9b444e0fbe802ecb89b589134_amd64RHSA-2026:48151
Fixed in:datasource-rhel9@sha256:89b841456cfe46bf4d3b6bd32dea131c51241d2b1bd266d408eac78ed79c395a_arm64RHSA-2026:48151
fetch-tsa-certs-cli-stackRed Hat / RHEL
Fixed in:v1-4@ppc64leRHSA-2026:36797
Fixed in:v1-4@amd64_darwinRHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:49767
Fixed in:v1-4@amd64RHSA-2026:49767
Fixed in:v1-4@amd64RHSA-2026:50888
Fixed in:v1-4@arm64RHSA-2026:50888
Fixed in:v1-4@ppc64leRHSA-2026:50888
fetch-tsa-certs-cli-stackRocky
Fixed in:v1-4@arm64RHSA-2026:48771
Fixed in:v1-4@amd64_windowsRHSA-2026:49767
Fixed in:v1-4@arm64RHSA-2026:37276
Fixed in:v1-4@ppc64leRHSA-2026:36797
Fixed in:v1-4@amd64_windowsRHSA-2026:50888
Fixed in:v1-4@s390xRHSA-2026:36797
Fixed in:v1-4@amd64_darwinRHSA-2026:50888
Fixed in:v1-4@ppc64leRHSA-2026:50888
flightctlRocky
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
flightctlRed Hat / RHEL
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
flightctl-agentRed Hat / RHEL
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
flightctl-agentRocky
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
flightctl-cliRocky
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
flightctl-cliRed Hat / RHEL
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
flightctl-observabilityRed Hat / RHEL
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
flightctl-observabilityRocky
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
flightctl-selinuxRocky
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
flightctl-selinuxRed Hat / RHEL
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
flightctl-servicesRocky
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
flightctl-servicesRed Hat / RHEL
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el10emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.1.3-1.el9emRHSA-2026:41019
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
flightctl-telemetry-gatewayRed Hat / RHEL
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796
Fixed in:0:1.0.3-1.el9emRHSA-2026:36796

This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Exploit Intelligence

0.50%probability of exploitation in 30 days
41stpercentile

Moderate risk: more likely to be exploited than 41% of all known CVEs.

References

Vendor Advisory1
Issue Tracking2
Mailing List1

Related Vulnerabilities

Other CWE-863 (Incorrect Authorization) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2023-22518Critical9.8100%KEV + RansomFix
CVE-2023-38035Critical9.8100%KEV + Ransom-
CVE-2022-46169Critical9.8100%KEVFix
CVE-2024-38856Critical9.899%KEVFix
CVE-2025-29927Critical9.199%-Fix
CVE-2020-36289Medium5.399%-Fix

Common questions

How do I fix CVE-2026-46595?

Published advisories record a fix for 313 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2026-46595 being actively exploited?

Not that we know of. CVE-2026-46595 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.50% is the estimated probability that it will be exploited in the next 30 days. That is higher than 41% of all scored CVEs.

How severe is CVE-2026-46595?

CVE-2026-46595 has a CVSS v3 base score of 10.0, rated critical. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2026-46595 affect?

Published advisories record a fix for golang-go.crypto (Debian), conforma-cli-stack (Rocky), conforma-cli-stack (Red Hat / RHEL), cosign-cli-stack (Rocky), and 309 more. The list on this page is capped, so there may be more.

Embed a live status badge for CVE-2026-46595
CVE-2026-46595 severity badge

Markdown

[![CVE-2026-46595](https://tridentstack.com/cve/badge/CVE-2026-46595.svg)](https://tridentstack.com/cve/CVE-2026-46595)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-46595"><img src="https://tridentstack.com/cve/badge/CVE-2026-46595.svg" alt="CVE-2026-46595"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it worksStart freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-08-28.