CVE-2026-39828 is a vulnerability in the golang.org/x/crypto/ssh library where an SSH server authentication callback returning a PartialSuccessError with non-nil permissions causes these permissions to be silently discarded. This flaw enables an attacker to bypass certificate restrictions like force-command after a second authentication factor succeeds, potentially leading to unauthorized command execution or access. The issue affects the RHTAS Policy Controller Operator used with OpenShift Container Platform versions 4.16 through 4.22. Red Hat has classified this as an important security flaw with a CVSS v3.1 base score of 8.8 (high severity). Currently, no official patch or mitigation meeting Red Hat's standards is available. The vulnerability impacts systems configured with multi-factor authentication and certificate-based access controls. Additional CVEs (CVE-2026-39829, CVE-2026-39830, CVE-2026-39835) are also associated with this advisory.

The vulnerability allows attackers to bypass SSH certificate restrictions, such as force-command, potentially leading to unauthorized command execution or access on affected Red Hat systems. This impacts confidentiality, integrity, and availability with high severity. Systems using multi-factor authentication and certificate-based access controls are at risk. There are no known exploits in the wild at this time.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of use, applicability, and stability is available. Users should monitor Red Hat advisories for updates. Consider reviewing your SSH authentication callback configurations and restrict usage of PartialSuccessError with non-nil permissions if possible. Engage with Red Hat support or Technical Account Managers for tailored guidance.