9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42508

CVE-2026-42508: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42508

CVE-2026-42508:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
golang.org/x/crypto	go	< 0.52.0	0.52.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-42508, is an authentication bypass flaw in the golang.org/x/crypto/ssh/knownhosts package. The root cause is an incomplete revocation check within the isRevoked function. When presented with an SSH certificate (ssh.Certificate), the function would check if the certificate itself was in the list of revoked keys, but it failed to also check if the Certificate Authority (CA) key that signed the certificate (SignatureKey) was revoked.

The patch, found in commit 2325ea8d134592d43353d2142856c14950939c33, rectifies this by adding a recursive call to isRevoked on the cert.SignatureKey. This ensures that the entire certificate chain of trust is validated against the revocation list.

The primary vulnerable function is the unexported isRevoked method, where the faulty logic resided. However, the exported IsRevoked method is the public API that calls this vulnerable function. Therefore, both functions would likely appear in a stack trace during exploitation. A security engineer should monitor calls to golang.org/x/crypto/ssh/knownhosts.(*HostKeyDB).IsRevoked as a potential indicator of compromise.

Vulnerable functions

golang.org/x/crypto/ssh/knownhosts.(*hostKeyDB).isRevoked

ssh/knownhosts/knownhosts.go

This unexported function contains the core logic for checking if a key is revoked. The vulnerability lies in this function's failure to recursively check the revocation status of the signing key for a given SSH certificate. An attacker could therefore present a certificate signed by a revoked Certificate Authority, and it would be accepted as valid. The patch adds this missing check.

golang.org/x/crypto/ssh/knownhosts.(*HostKeyDB).IsRevoked

ssh/knownhosts/knownhosts.go

This is the exported function that developers use to check for key revocation. It acts as a wrapper around the vulnerable `isRevoked` function. Any call to check for a revoked certificate would go through this function, making it a key indicator of the vulnerability being triggered in a runtime profile.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.