Red Hat Patches Four Go Library Flaws in FDO Device Onboarding Server for Enterprise Linux 10
Red Hat has issued security advisory RHSA-2026:97387 for go-fdo-server, the Go based server-side implementation of the FIDO Device Onboard specification shipped with Red Hat Enterprise Linux 10. The advisory is rated Important by Red Hat Product Security and bundles fixes for four vulnerabilities inherited from the Go standard library: CVE-2026-27137 in crypto/x509, CVE-2026-25679 in net/url, CVE-2026-33811 in the net package, and CVE-2026-56859 in encoding/xml. Affected builds run on Red Hat Enterprise Linux for x86_64 10 and Red Hat Enterprise Linux for ARM 64 10, covering the manufacturer, owner and rendezvous server roles as well as the base package. The corrected build is go-fdo-server-1.0.1-6.el10_3, published on 10 November 2026. Organisations that use FDO to automate the onboarding of edge devices and IoT hardware are the population in scope.
Red Hat has not published exploitation details or attack scenarios for any of the four issues, so the mechanism is known only from the component-level descriptions in the advisory and the linked Bugzilla entries. The crypto/x509 issue is described as incorrect enforcement of email constraints, meaning name constraints intended to limit which identities a certificate authority may vouch for are not applied as expected. The net/url issue is incorrect parsing of IPv6 host literals, a class of flaw that historically causes one component to read a URL differently from another. The remaining two are denial of service conditions: a long CNAME response handled by LookupCNAME in the net package, and a recursion depth problem in XML decoding. In each case the vulnerable code sits in the Go runtime libraries that go-fdo-server is compiled against rather than in FDO protocol logic written by the project itself.
The practical exposure depends on how the FDO server estate is deployed. Rendezvous and owner services are designed to be reachable by devices arriving on a network for the first time, which places certificate validation and URL parsing directly on an untrusted input path, and an availability failure in an onboarding service stalls device provisioning rather than taking down a production workload. Weakened enforcement of x509 email constraints matters most where an internal or delegated certificate authority is trusted on the assumption that those constraints hold. Current exploitation data does not point to active abuse: FIRST EPSS places CVE-2026-27137 at a 0.7 percent probability of exploitation in the next 30 days, CVE-2026-25679 at 0.8 percent, CVE-2026-33811 at 0.9 percent and CVE-2026-56859 at 0.6 percent. None of the four appears in the verified exploitation evidence as confirmed in the wild, and Red Hat describes no observed attacks. This is a scheduled maintenance item for RHEL 10 fleets running FDO infrastructure, not an incident response trigger.
Attack Surface
Server OS, IoT, Infrastructure
Tactics
Impact, Credential Access
Techniques
- T1499 – Endpoint Denial of Service
- T1498 – Network Denial of Service
- T1557 – Adversary-in-the-Middle
SuperPRO's Threat Countermeasures Procedures
- Update go-fdo-server to 1.0.1-6.el10_3 or later on Red Hat Enterprise Linux 10 for x86_64 and ARM 64 using dnf update go-fdo-server, which carries the fixes for CVE-2026-27137, CVE-2026-25679, CVE-2026-33811 and CVE-2026-56859.
- Update the role sub-packages alongside the base package, specifically go-fdo-server-manufacturer, go-fdo-server-owner and go-fdo-server-rendezvous at 1.0.1-6.el10_3, since hosts may run only one of these noarch components.
- Inventory affected systems with rpm -q go-fdo-server across the RHEL 10 estate, or use the Red Hat Lightspeed patch analysis view for RHSA-2026:97387 to list systems still reporting the vulnerable build.
- Verify downloaded RPMs against the published SHA-256 values in RHSA-2026:97387 before deployment, for example 71940dd56f67e3fcd585aa4113c86d7e2a32b3f5cee154d389dddd85f338d3d9 for go-fdo-server-1.0.1-6.el10_3.x86_64.rpm.
- Restrict network reachability of the FDO rendezvous and owner service listeners to the device provisioning VLAN or an allow-listed set of manufacturing and edge subnets, so that untrusted clients cannot reach the XML decoding and URL parsing paths touched by CVE-2026-56859 and CVE-2026-25679.
- Alert on repeated process restarts, out-of-memory kills or sustained CPU saturation of the go-fdo-server systemd units in journald, as these are the observable signs of the LookupCNAME and XML recursion denial of service conditions being triggered.
- Review which internal or delegated certificate authorities are trusted by the FDO owner service and confirm that authorisation does not rely solely on x509 email name constraints, which CVE-2026-27137 shows were not enforced correctly in pre-patch builds.
