[Project Darkstar] ACM-39651: Remediate 7 Go stdlib CVEs in assisted-service

[kseiter-rh]

[Project Darkstar] ACM-39651: Remediate CVEs in assisted-service

Changes

• Update toolchain go1.26.2 → toolchain go1.26.5 in go.mod, api/go.mod, client/go.mod, models/go.mod

Fixed — Go stdlib (7 CVEs)

• CVE-2026-39820 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-33814 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-33811 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-42499 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-27145 (stdlib, CVSS 7.5) — fix: Go 1.26.4+
• CVE-2026-42504 (stdlib, CVSS 7.5) — fix: Go 1.26.4+
• CVE-2026-39822 (stdlib, CVSS 7.5) — fix: Go 1.26.5+

Already Fixed (3 CVEs)

The following CVEs are already resolved in the current source:

• CVE-2026-46595 (golang.org/x/crypto) — current v0.52.0 >= fix version
• CVE-2026-39831 (golang.org/x/crypto) — current v0.52.0 >= fix version
• CVE-2026-33186 (google.golang.org/grpc) — current v1.79.3 >= fix version

Not In This PR

• CVE-2026-33816 (pgx/v5, CVSS 9.8) — fix available in v5.9.0, current v5.6.0. Requires separate module bump PR (Dependabot has not generated one). Critical — recommend manual bump.
• CVE-2026-33815 (pgx/v5, CVSS 8.3) — same, fix in v5.9.0
• CVE-2026-46600 (golang.org/x/net) — deferred to Dependabot

No Fix Available

• 17 RPM-level CVEs (curl-minimal, openshift-clients, containerd) — no upstream fix

FedRAMP SLA: Critical/Important CVEs must be remediated within 30 days of detection.

About Project Darkstar

Summary by CodeRabbit

• Chores
  • Updated the application’s Go toolchain version to 1.26.5 across all modules.
  • Improves consistency and compatibility with the latest supported Go toolchain.

[openshift-ci-robot]

@kseiter-rh: This pull request references ACM-39651 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

[Project Darkstar] ACM-39651: Remediate CVEs in assisted-service

Changes

• Update toolchain go1.26.2 → toolchain go1.26.5 in go.mod, api/go.mod, client/go.mod, models/go.mod

Fixed — Go stdlib (7 CVEs)

• CVE-2026-39820 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-33814 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-33811 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-42499 (stdlib, CVSS 7.5) — fix: Go 1.26.3+
• CVE-2026-27145 (stdlib, CVSS 7.5) — fix: Go 1.26.4+
• CVE-2026-42504 (stdlib, CVSS 7.5) — fix: Go 1.26.4+
• CVE-2026-39822 (stdlib, CVSS 7.5) — fix: Go 1.26.5+

Already Fixed (3 CVEs)

The following CVEs are already resolved in the current source:

• CVE-2026-46595 (golang.org/x/crypto) — current v0.52.0 >= fix version
• CVE-2026-39831 (golang.org/x/crypto) — current v0.52.0 >= fix version
• CVE-2026-33186 (google.golang.org/grpc) — current v1.79.3 >= fix version

Not In This PR

• CVE-2026-33816 (pgx/v5, CVSS 9.8) — fix available in v5.9.0, current v5.6.0. Requires separate module bump PR (Dependabot has not generated one). Critical — recommend manual bump.
• CVE-2026-33815 (pgx/v5, CVSS 8.3) — same, fix in v5.9.0
• CVE-2026-46600 (golang.org/x/net) — deferred to Dependabot

No Fix Available

• 17 RPM-level CVEs (curl-minimal, openshift-clients, containerd) — no upstream fix

FedRAMP SLA: Critical/Important CVEs must be remediated within 30 days of detection.

About Project Darkstar

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 904e0931-bf85-4eba-b56d-4f6bd0c520d8

📥 Commits

Reviewing files that changed from the base of the PR and between 368458c and 98e11d7.

📒 Files selected for processing (4)

• api/go.mod
• client/go.mod
• go.mod
• models/go.mod

---

Walkthrough

The pull request updates the required Go toolchain version from 1.26.2 to 1.26.5 in the root, API, client, and models modules.

Changes

Go toolchain alignment

Layer / File(s)	Summary
Update toolchain directives go.mod, api/go.mod, client/go.mod, models/go.mod	Each module now requires Go 1.26.5 instead of Go 1.26.2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: shay23bra

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: updating assisted-service to remediate seven Go standard-library CVEs.
Description check	✅ Passed	The description explains the toolchain updates, linked issue, CVE scope, exclusions, and remaining risks, but omits the repository template sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only four Go module toolchain directives; it adds or modifies no test files or Ginkgo test titles.
Test Structure And Quality	✅ Passed	The commit changes only four go.mod toolchain directives and adds no Ginkgo test code, so no structure, cleanup, timeout, or assertion issues are introduced.
Microshift Test Compatibility	✅ Passed	The PR changes only four go.mod toolchain directives; HEAD-parent diff adds no Ginkgo tests or other test code requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. Changes are limited to Go toolchain version updates in four go.mod files. The SNO compatibility check does not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	This PR modifies only Go toolchain directives in go.mod files, not deployment manifests, operator code, or controllers. The custom check does not apply to dependency management changes.
Ote Binary Stdout Contract	✅ Passed	The commit changes only toolchain directives in four go.mod files; it adds no OTE binary, suite setup, or process-level stdout/logging code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only four go.mod toolchain directives; it adds no Ginkgo e2e tests or networking/external-connectivity logic.
No-Weak-Crypto	✅ Passed	HEAD changes only four go.mod toolchain lines; no weak algorithm, custom crypto implementation, or secret comparison was added.
Container-Privileges	✅ Passed	PR contains only Go toolchain version updates in go.mod files; no container/K8s manifests were modified, making the container-privileges check not applicable.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes only four toolchain directives from go1.26.2 to go1.26.5; it adds no logging or sensitive-data output.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kseiter-rh
Once this PR has been reviewed and has the lgtm label, please assign eranco74 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment