RHSA-2026:37278HighCVSS 8.8

Red Hat Security Advisory: RHTAS 1.4.2 - Tech Preview Release Of the Go based Model Transparency CLI

Published
July 9, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (3)

CVE-2026-39828 →CVE-2026-39829 →CVE-2026-39830 →

📋 Description

CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

🎯 Affected products5

  • Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:9c1430c79d63007b5a3d86cfa613da19d81d1874b15b05df001f026efea7a2cd_arm64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:a36ec195ebd459a5874dadf181342908c0fbd2b3fadc05622125744e686c88b4_s390x as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:b2f4d793fb7ea549ec05afd97cf3bdea964ebd33a08a862486392953cfe64f8f_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-transparency-cli-rhel9@sha256:fa965992a2480108fbd659278832e1dfcbdd2f4d4dcc0f5e8f5654ffdda083ef_amd64 as a component of Red Hat Trusted Artifact Signer 1.4

✅ Remediation

The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor). For details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.

🔗 References (7)