RHSA-2026:37286HighCVSS 8.8

Red Hat Security Advisory: RHTAS 1.4.2 - Tech Preview Release Of the Model Validation Operator

Published
July 9, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (4)

CVE-2026-39828 →CVE-2026-39829 →CVE-2026-39830 →CVE-2026-39835 →

📋 Description

CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

🎯 Affected products4

  • Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-validation-agent-rhel9@sha256:6409e1710402e613a2b2b41a89bc8080ce91c1c2f22163a0de372f90c4729658_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-validation-operator-bundle@sha256:eb42bac42219880d3e454871f55b4cdb6792e1509f4722981485f32abff8674c_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/model-validation-rhel9-operator@sha256:02238a2098a2c2fe5d511e2204cceec2d9b29a4d84ca985e2b19e1173fd3374d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4

✅ Remediation

The Model Validation Operator is a Go-based Kubernetes operator for OpenShift that validates AI/ML models and their signatures at pod runtime. It verifies signatures on model and container artifacts before workloads are allowed to run. Platform Engineers, ML practitioners, and Security teams use it to ensure only trusted, compliant models execute on OCP clusters, in both connected and disconnected environments. For details on using the RHTAS Model Validation Operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.

🔗 References (9)