PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 27 By PatchDayAlert

Go SSH silently trusts revoked host keys, NGINX rewrite bypass, and an Oracle DB takeover path

CVE-2026-42508 (CVSS 9.1) means your Go SSH tooling ignores @revoked markers in known_hosts. Also: an NGINX rewrite module access-control bypass at CVSS 8.1, a Perl Archive::Tar symlink path traversal at 9.1, and an unauthenticated Oracle Database Net listener takeover at 9.0. None exploited in the wild yet.

Patch now
0
Within 24h
4
This week
1
Exploited
0
Go Crypto/SshLibcontainers CommonPackerTelegrafLinuxNGINXLinux KernelPerlArchive::TarOracle Database ServerOracle Net ServiceWindows

Five high-severity CVEs today, none exploited in the wild yet, but a couple deserve your attention before the weekend. The Go SSH known_hosts library is silently ignoring @revoked markers (CVE-2026-42508, CVSS 9.1), which means any host key you thought you revoked still passes validation. If your tooling uses Go's SSH libraries for host trust, that safety net has a hole in it. NGINX's rewrite module also picked up a CVSS 8.1 access-control bypass that's worth patching fast given how many configs touch rewrite rules.

Today's CVEs

Sorted by urgency

01

CVE-2026-42508

MSRC
9.1
CVSS EPSS 0.04%
Patch within 24h CRITICAL
Go Crypto/SshLibcontainers CommonPackerTelegrafLinux

The Go SSH known_hosts library doesn't enforce @revoked markers, so a host key you explicitly revoked still passes validation. An attacker who controls a revoked key can impersonate a trusted host and intercept SSH sessions without triggering any warning. CVSS 9.1, not yet exploited in the wild, but any Go tooling that relies on known_hosts for SSH trust is silently skipping a critical safety check.

Affected estate
Anyone running Azure Linux 3.0 packages that bundle golang.org/x/crypto/ssh, specifically libcontainers-common 20240213-3, packer 1.9.5-13, or telegraf 1.31.0-19
How to check
Run `tdnf list installed | grep -E 'libcontainers-common|packer|telegraf'` and compare versions against the advisory.
Included because
unauthenticated; network-accessible; CVSS 9.1; auth bypass undermines SSH trust model
Action
Run `tdnf update libcontainers-common packer telegraf` to pull fixed packages.
Why it matters
Revoked SSH host keys are silently trusted, which means a compromised host you thought you cut off can still intercept traffic.
Source
Azure Linux 3.0 advisory

Evidence trail

02

CVE-2026-9256

MSRC
8.1
CVSS EPSS 0.18%
Patch within 24h HIGH
NGINXLinux

A vulnerability in NGINX's rewrite module (ngx_http_rewrite_module) could let an attacker abuse rewrite rules to bypass access controls or trigger unexpected behavior. Details are sparse, but the CVSS 8.1 and the fact that this sits in the rewrite module, which almost every NGINX config uses, makes it worth patching quickly. Not yet exploited in the wild.

Affected estate
Anyone running NGINX 1.28.3-1 on Azure Linux 3.0, and anyone else using the same upstream NGINX version with the rewrite module enabled
How to check
Run `nginx -v` or `tdnf list installed nginx` and confirm the installed version.
Included because
internet-facing; common product; CVSS 8.1; rewrite module is ubiquitous
Action
Run `tdnf update nginx` and restart the service.
Why it matters
The rewrite module is enabled in nearly every NGINX deployment, so the blast radius is wide if this is weaponized.
Source
Azure Linux 3.0 advisory

Evidence trail

03

CVE-2025-71305

MSRC
9.8
CVSS EPSS 0.02%
Patch this week CRITICAL
Linux KernelLinux

A missing check for zero VCPI (Virtual Channel Payload Identifier) in the kernel's DisplayPort MST (Multi-Stream Transport) code can cause a crash or memory corruption. Despite the CVSS 9.8, this is a local kernel bug in the display subsystem. You'd need a malicious or buggy MST display device connected to trigger it. If you're running headless Azure Linux VMs with no display hardware, the real-world risk is low.

Affected estate
Anyone running Azure Linux 3.0 with kernel 6.6.139.1-1, especially systems with DisplayPort MST hardware attached
How to check
Run `uname -r` and confirm the running kernel version.
Included because
CVSS 9.8; kernel-level bug; mitigated by hardware requirement on most cloud workloads
Action
Run `tdnf update kernel`, then schedule a reboot.
Why it matters
On systems with DisplayPort MST hardware, this could cause kernel panics or potential code execution, but headless servers are not practically exposed.
Source
Azure Linux 3.0 advisory

Evidence trail

04

CVE-2026-42496

MSRC
9.1
CVSS EPSS 0.04%
Patch within 24h CRITICAL
PerlArchive::TarLinux

Archive::Tar for Perl (versions before 3.08) follows symlinks during extraction without validating the target path. An attacker who crafts a malicious tar archive can write or overwrite files anywhere on the filesystem that the extracting process can reach. If any of your automation or CI pipelines extract untrusted tar files using Perl's Archive::Tar, this is a path traversal straight to arbitrary file write.

Affected estate
Anyone running Perl 5.38.2-509 on Azure Linux 3.0, and anyone using Archive::Tar < 3.08 in scripts or automation that process untrusted archives
How to check
Run `perl -MArchive::Tar -e 'print $Archive::Tar::VERSION'` to check the module version.
Included because
unauthenticated; CVSS 9.1; common scripting language; symlink attacks are well-understood and easy to exploit
Action
Run `tdnf update perl` or install Archive::Tar >= 3.08 from CPAN.
Why it matters
Arbitrary file write via symlink traversal can lead to full system compromise if archives from untrusted sources are extracted.
Source
Azure Linux 3.0 advisory

Evidence trail

05

CVE-2026-46833

NVD
9.0
CVSS
Patch within 24h CRITICAL
Oracle Database ServerOracle Net ServiceWindowsLinux

An unauthenticated attacker with network access via TLS can potentially take over the Oracle Database Net Service component, and successful exploitation can pivot to affect other products (scope change). The catch: it's rated high complexity, meaning it's hard to pull off. Still, a CVSS 9.0 with no auth required on a network-facing database listener is not something to sit on.

Affected estate
Oracle Database Server operators running versions 23.4.0 through 23.26.2 with Net Service exposed on the network
How to check
Query `SELECT VERSION_FULL FROM V$INSTANCE;` or run `lsnrctl version` to confirm the database and listener versions.
Included because
unauthenticated; network-accessible via TLS; CVSS 9.0 with scope change; database listeners are commonly internet or network exposed
Action
Apply the latest Oracle Critical Patch Update for Database Server 23.x from Oracle Support.
Why it matters
Unauthenticated full takeover of the Net Service with scope change means an attacker could pivot from the listener to other components or services.
Source
Oracle Critical Patch Update advisory

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →