AIKIDO-2026-11027
golang.org/x/crypto is vulnerable to Authorization Bypass
91
Critical Risk
This Affects:
golang.org/x/cryptoTL;DR
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and if you use the golang.org/x/crypto/ssh/knownhosts functionalities.
Background info
golang.org/x/crypto is vulnerable to Authorization Bypass in versions 0.0.0 - 0.51.0.
How to fix this
Upgrade the golang.org/x/crypto library to the patch version.
Links
pkg.go.dev/vuln/GO-2026-5021go.dev/cl/781220go.dev/issue/79568groups.google.com/g/golang-announce/c/a082jnz-LvIaccess.redhat.com/errata/RHSA-2026:23262access.redhat.com/errata/RHSA-2026:23264access.redhat.com/errata/RHSA-2026:26546access.redhat.com/errata/RHSA-2026:26547access.redhat.com/errata/RHSA-2026:35833access.redhat.com/errata/RHSA-2026:36648access.redhat.com/errata/RHSA-2026:36651access.redhat.com/errata/RHSA-2026:36796access.redhat.com/errata/RHSA-2026:36797access.redhat.com/errata/RHSA-2026:36808access.redhat.com/errata/RHSA-2026:37072access.redhat.com/errata/RHSA-2026:37123access.redhat.com/errata/RHSA-2026:37387access.redhat.com/security/cve/CVE-2026-42508bugzilla.redhat.com/show_bug.cgi?id=2480688security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant