CVE-2026-39828 is a vulnerability in the golang.org/x/crypto/ssh library where an SSH server authentication callback returning a PartialSuccessError with non-nil permissions causes these permissions to be silently discarded. This results in the bypass of certificate restrictions like force-command after a second authentication factor succeeds. The flaw affects Red Hat Trusted Artifact Signer (RHTAS) used with OpenShift Container Platform versions 4.17 through 4.22. The vulnerability can lead to unauthorized command execution or access on affected systems configured with multi-factor authentication and certificate-based access controls. Red Hat has classified this as an Important security flaw with a CVSS v3 score of 8.8. Currently, no mitigation or patch meeting Red Hat's standards for ease of use, applicability, and stability is available.

The vulnerability allows an attacker to bypass SSH certificate restrictions, potentially leading to unauthorized command execution or access on affected Red Hat systems using multi-factor authentication and certificate-based access controls. This compromises confidentiality, integrity, and availability of the affected systems.

Red Hat currently does not provide a mitigation or patch that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. In the meantime, consider restricting SSH access and reviewing authentication callback configurations to minimize exposure. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for guidance.