The vulnerability (CVE-2026-39828) exists in the golang.org/x/crypto/ssh library, where an SSH server configured with specific authentication callbacks returning a PartialSuccessError with non-nil permissions silently discards these permissions. This flaw enables an attacker to bypass certificate restrictions such as force-command after a second authentication factor succeeds, potentially resulting in unauthorized command execution or access. The issue affects Red Hat Trusted Artifact Signer Operator versions 4.17 through 4.22 running on OpenShift Container Platform. Red Hat has classified this as an important security flaw with a high severity rating but currently has no available patch or mitigation that meets their standards. The flaw relates to improper preservation of permissions (CWE-281) and is associated with other CWEs including CWE-1284, CWE-772, and CWE-476. Red Hat advises monitoring their advisories and engaging with technical account managers for further guidance.

Successful exploitation of this vulnerability can lead to unauthorized command execution or access on affected Red Hat systems that use multi-factor authentication and certificate-based access controls via SSH. The attacker can bypass intended certificate restrictions, potentially compromising system integrity, confidentiality, and availability. The severity is rated high by Red Hat, reflecting significant risk to affected deployments.

Currently, no official patch or fix is available for this vulnerability in Red Hat Trusted Artifact Signer. Red Hat states that existing mitigation options do not meet their criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat advisories for updates and consult with Red Hat Technical Account Managers if available. Until a fix is released, organizations should carefully evaluate their SSH authentication configurations and consider limiting exposure of affected systems.