PatchDay Alert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 27 By PatchDay Alert

Go SSH silently trusts revoked host keys, NGINX rewrite bypass, and an Oracle DB takeover path

CVE-2026-42508 (CVSS 9.1) means your Go SSH tooling ignores @revoked markers in known_hosts. Also: an NGINX rewrite module access-control bypass at CVSS 8.1, a Perl Archive::Tar symlink path traversal at 9.1, and an unauthenticated Oracle Database Net listener takeover at 9.0. None exploited in the wild yet.

Patch now
0
Within 24h
4
This week
1
Exploited
0
Go Crypto/SshLibcontainers CommonPackerTelegrafLinuxNGINXLinux KernelPerlArchive::TarOracle Database ServerOracle Net ServiceWindows

Five high-severity CVEs today, none exploited in the wild yet, but a couple deserve your attention before the weekend. The Go SSH known_hosts library is silently ignoring @revoked markers (CVE-2026-42508, CVSS 9.1), which means any host key you thought you revoked still passes validation. If your tooling uses Go's SSH libraries for host trust, that safety net has a hole in it. NGINX's rewrite module also picked up a CVSS 8.1 access-control bypass that's worth patching fast given how many configs touch rewrite rules.

Today's CVEs

Sorted by urgency

01

CVE-2026-42508

MSRC
9.1
CVSS EPSS 0.04%
Patch within 24h CRITICAL
Go Crypto/SshLibcontainers CommonPackerTelegrafLinux

The Go SSH known_hosts library doesn't enforce @revoked markers, so a host key you explicitly revoked still passes validation. An attacker who controls a revoked key can impersonate a trusted host and intercept SSH sessions without triggering any warning. CVSS 9.1, not yet exploited in the wild, but any Go tooling that relies on known_hosts for SSH trust is silently skipping a critical safety check.

Included because
unauthenticated; network-accessible; CVSS 9.1; auth bypass undermines SSH trust model
Affected estate
Azure Linux 3.0 systems running libcontainers-common 20240213-3, packer 1.9.5-13, or telegraf 1.31.0-19
How to check
Run `tdnf list installed | grep -E 'libcontainers-common|packer|telegraf'` and compare versions against the advisory.
Action
Run `tdnf update libcontainers-common packer telegraf` to pull fixed packages.
Urgency
Patch within 24 hours
Why it matters
Revoked SSH host keys are silently trusted, which means a compromised host you thought you cut off can still intercept traffic.
Source
Azure Linux 3.0 advisory

Evidence trail

02

CVE-2026-9256

MSRC
8.1
CVSS EPSS 0.18%
Patch within 24h HIGH
NGINXLinux

A vulnerability in NGINX's rewrite module (ngx_http_rewrite_module) could let an attacker abuse rewrite rules to bypass access controls or trigger unexpected behavior. Details are sparse, but the CVSS 8.1 and the fact that this sits in the rewrite module, which almost every NGINX config uses, makes it worth patching quickly. Not yet exploited in the wild.

Included because
internet-facing; common product; CVSS 8.1; rewrite module is ubiquitous
Affected estate
Azure Linux 3.0 systems running nginx 1.28.3-1
How to check
Run `nginx -v` or `tdnf list installed nginx` and confirm the installed version.
Action
Run `tdnf update nginx` and restart the service.
Urgency
Patch within 24 hours
Why it matters
The rewrite module is enabled in nearly every NGINX deployment, so the blast radius is wide if this is weaponized.
Source
Azure Linux 3.0 advisory

Evidence trail

03

CVE-2025-71305

MSRC
9.8
CVSS EPSS 0.02%
Patch this week CRITICAL
Linux KernelLinux

A missing check for zero VCPI (Virtual Channel Payload Identifier) in the kernel's DisplayPort MST (Multi-Stream Transport) code can cause a crash or memory corruption. Despite the CVSS 9.8, this is a local kernel bug in the display subsystem. You'd need a malicious or buggy MST display device connected to trigger it. If you're running headless Azure Linux VMs with no display hardware, the real-world risk is low.

Included because
CVSS 9.8; kernel-level bug; mitigated by hardware requirement on most cloud workloads
Affected estate
Azure Linux 3.0 systems running kernel 6.6.139.1-1
How to check
Run `uname -r` and confirm the running kernel version.
Action
Run `tdnf update kernel`, then schedule a reboot.
Urgency
Patch this week
Why it matters
On systems with DisplayPort MST hardware, this could cause kernel panics or potential code execution, but headless servers are not practically exposed.
Source
Azure Linux 3.0 advisory

Evidence trail

04

CVE-2026-42496

MSRC
9.1
CVSS EPSS 0.04%
Patch within 24h CRITICAL
PerlArchive::TarLinux

Archive::Tar for Perl (versions before 3.08) follows symlinks during extraction without validating the target path. An attacker who crafts a malicious tar archive can write or overwrite files anywhere on the filesystem that the extracting process can reach. If any of your automation or CI pipelines extract untrusted tar files using Perl's Archive::Tar, this is a path traversal straight to arbitrary file write.

Included because
unauthenticated; CVSS 9.1; common scripting language; symlink attacks are well-understood and easy to exploit
Affected estate
Azure Linux 3.0 systems with perl 5.38.2-509 installed; any system using Archive::Tar < 3.08
How to check
Run `perl -MArchive::Tar -e 'print $Archive::Tar::VERSION'` to check the module version.
Action
Run `tdnf update perl` or install Archive::Tar >= 3.08 from CPAN.
Urgency
Patch within 24 hours
Why it matters
Arbitrary file write via symlink traversal can lead to full system compromise if archives from untrusted sources are extracted.
Source
Azure Linux 3.0 advisory

Evidence trail

05

CVE-2026-46833

NVD
9.0
CVSS
Patch within 24h CRITICAL
Oracle Database ServerOracle Net ServiceWindowsLinux

An unauthenticated attacker with network access via TLS can potentially take over the Oracle Database Net Service component, and successful exploitation can pivot to affect other products (scope change). The catch: it's rated high complexity, meaning it's hard to pull off. Still, a CVSS 9.0 with no auth required on a network-facing database listener is not something to sit on.

Included because
unauthenticated; network-accessible via TLS; CVSS 9.0 with scope change; database listeners are commonly internet or network exposed
Affected estate
Oracle Database Server versions 23.4.0 through 23.26.2, specifically the Net Service (listener) component
How to check
Query `SELECT VERSION_FULL FROM V$INSTANCE;` or run `lsnrctl version` to confirm the database and listener versions.
Action
Apply the latest Oracle Critical Patch Update for Database Server 23.x from Oracle Support.
Urgency
Patch within 24 hours
Why it matters
Unauthenticated full takeover of the Net Service with scope change means an attacker could pivot from the listener to other components or services.
Source
Oracle Critical Patch Update advisory

Evidence trail

One email, every weekday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →