The vulnerability CVE-2026-42508 in golang.org/x/crypto/ssh/knownhosts involves improper certificate validation due to failure to check revocation status of the 'SignatureKey' associated with a certificate authority. Previously, only the primary 'key' was checked for revocation, allowing a revoked CA key to be trusted erroneously. The fix involves verifying both the 'key' and its 'SignatureKey' for revocation status to prevent bypass. This vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating remote exploitation with no privileges or user interaction required, resulting in high confidentiality and integrity impact. Red Hat has issued security advisories and patches for affected products including Red Hat Edge Manager.

Successful exploitation of this vulnerability allows an attacker to bypass certificate revocation checks, potentially enabling unauthorized access or impersonation by using revoked CA keys. This compromises the confidentiality and integrity of SSH connections relying on the affected knownhosts package. The vulnerability does not impact availability. No known exploits in the wild have been reported at this time.

Red Hat has published security advisories and issued patches addressing CVE-2026-42508. Users of affected Red Hat products, including Red Hat Edge Manager, should apply the official security updates as provided in the Red Hat advisories (e.g., RHSA-2026:23262, RHSA-2026:23264). There is no indication that this vulnerability is mitigated by default or requires no action. Patch status is confirmed by vendor advisories; therefore, applying these official fixes is the recommended mitigation.