CVE-2026-39828 is a vulnerability in the golang.org/x/crypto/ssh library where an SSH server configured with authentication callbacks that return a PartialSuccessError with non-nil permissions silently discards those permissions. This flaw enables an attacker to bypass certificate restrictions like force-command after a second authentication factor succeeds, potentially resulting in unauthorized command execution or access. The issue affects Red Hat products using this library, including the RHTAS Model Validation Operator for OpenShift Container Platform versions 4.16 to 4.22. Red Hat has classified this as an important security flaw with a high severity rating but currently has no fix or suitable mitigation available. The vulnerability is tracked under multiple CVEs including CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, and CVE-2026-39835.

The vulnerability allows attackers to bypass SSH certificate restrictions, such as force-command, leading to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls. This compromises confidentiality, integrity, and availability of affected systems. There are no known exploits in the wild at this time.

Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is available, consider restricting SSH access and reviewing authentication callback configurations to minimize exposure. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. No official remediation is currently available.