Skip to content
Fedora opkssh Low Severity Advisory for GQ-commitment PK Tokens Vulnerability

Fedora opkssh Low Severity Advisory for GQ-commitment PK Tokens Vulnerability

First seen 28 Jul 2026, 10:02 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 29, 2026 at 05:12 UTC
  • •Fedora released opkssh version 0.16.0 on July 19, 2026, to address a low-severity vulnerability.
  • •The vulnerability affects GitLab-CI GQ-commitment PK Tokens but is not reachable through opkssh.
  • •Users are urged to update to the latest version and audit Linux privileges to enhance security.

On July 19, 2026, Fedora released an advisory for opkssh version 0.16.0, addressing a low-severity vulnerability related to GQ-commitment PK Tokens. This vulnerability affects GitLab-CI GQ-commitment PK Tokens but is not reachable through opkssh, which currently only supports GitLab user OP. The update upgrades the openpubkey dependency to v0.25.0 and drops the obsolete go-jose dependency pin. Users are advised to audit Linux privileges to limit potential compromise and escalation. The advisory emphasizes the importance of updating to the latest version to maintain security. The severity of the issue is classified as low due to the lack of exploitability through the affected tool. The update can be installed using the 'dnf' update program.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 55d ago How this analysis works

Timeline

2026-07-19
Fedora releases opkssh version 0.16.0
The update addresses a low-severity vulnerability related to GQ-commitment PK Tokens and upgrades the openpubkey dependency.
Linuxsecurity
2026-07-28
Advisory published for opkssh vulnerability
Fedora published an advisory detailing the low-severity vulnerability and urging users to update and audit privileges.
Linuxsecurity

More articles in this cluster (2)

Extracted Entities (3)

1 / 2