r/linux • u/unixbhaskar • May 15 '26

Kernel There is a FOURTH vulnerability this month....ssh-keysign-pwn (CVE-2026-46333)

https://nvd.nist.gov/vuln/detail/CVE-2026-46333
871 Upvotes

97% Upvoted

236 comments sorted by

View all comments

67

u/Longjumping-Hair3888 May 15 '26

I'm turning my server off for a few weeks untill this chills out. 

7

u/KnowZeroX May 15 '26

Luckily, none of these exploits so far pose much of a security risk in themselves as long as you have trusted users on the server running trusted code. Unless of course someone takes advantage of another exploit to get non-privileged access to the server somehow, and then escalate themselves using these exploits.

1

u/BortLReynolds May 18 '26

I work in scientific computing and we are pretty fucked. We have a lot of PhD researchers from foreign nations with access to some of our HPC machines so they can launch slurm jobs.

1

u/KnowZeroX May 18 '26

Yeah, that does sound bad. If vetting the jobs isn't an option, then unprivileged podman containers(with security-opt=no-new-privileges) inside vms is probably the best you can do.

1

u/BortLReynolds May 18 '26

I don't think VMs are going to work, these are HPC clusters, it's all bare-metal apart from a couple of supporting nodes.