[CVE-2026-46595] unfixed on AKS 1.35.6 shipping images: azure-cns v1.8.6-0, tigera/operator v1.40.2, calico v3.31.2 (golang.org/x/crypto < 0.52.0)

## Summary

`CVE-2026-46595` (SSH source-address-check bypass in `golang.org/x/crypto`, fixed in `v0.52.0`) is still present in several images that AKS 1.35.6 ships (via the 2026-07-17 release train):

- `mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0`
- `mcr.microsoft.com/mirror/quay/tigera/operator:v1.40.2`
- `mcr.microsoft.com/mirror/quay/calico/node:v3.31.2`
- `mcr.microsoft.com/mirror/quay/calico/typha:v3.31.2`
- `mcr.microsoft.com/mirror/quay/calico/kube-controllers:v3.31.2`

Clusters on `automaticChannel=patch` + `nodeOsUpgradeChannel=NodeImage` receive the current AKS 1.35 shipping set and cannot bypass these tags. The [2026-07-17 release notes](https://github.com/Azure/AKS/releases/tag/2026-07-17) `Component updates` section does not list azure-cns / tigera-operator / calico bumps, and the earlier [2026-06-19](https://github.com/Azure/AKS/releases/tag/2026-06-19) release notes are similarly silent, so no in-place refresh has landed yet on the 1.35 track.

## CVE details

- **CVE:** [CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595)
- **Package:** `golang.org/x/crypto` SSH server side
- **Vulnerable:** `< 0.52.0`
- **Fixed:** `>= 0.52.0`
- **Source of fix:** [golang/go#79570](https://go.dev/issue/79570), CL [781642](https://go.dev/cl/781642), [golang-announce](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- **CVSS 3.1 (CISA-ADP):** 10.0 Critical

## Per-image evidence (upstream `go.mod` at the tag AKS ships)

| Image tag on AKS 1.35 | Upstream `go.mod` reference | `golang.org/x/crypto` |
|---|---|---|
| `azure-cns:v1.8.6-0` | [`Azure/azure-container-networking@v1.8.6` go.mod](https://raw.githubusercontent.com/Azure/azure-container-networking/v1.8.6/go.mod) | **`v0.46.0`** — vulnerable |
| `tigera/operator:v1.40.2` | [`tigera/operator@v1.40.2` go.mod](https://raw.githubusercontent.com/tigera/operator/v1.40.2/go.mod) | **`v0.43.0`** — vulnerable |
| `calico/node:v3.31.2` / `typha:v3.31.2` / `kube-controllers:v3.31.2` | [`projectcalico/calico@v3.31.2` go.mod](https://raw.githubusercontent.com/projectcalico/calico/v3.31.2/go.mod) | **`v0.43.0`** — vulnerable |

## Live confirmation (representative AKS 1.35.6 cluster)
kubectl get pods -A -o jsonpath='{range .items[]}{range .status.containerStatuses[]}{.image}{"|"}{.imageID}{"\n"}{end}{end}'

Returns, among other rows:
mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0|sha256:7d200184b363d51d2abe9665c60fe8113bbfd6d8708d9aa4806a2d7c55c4e8fa
mcr.microsoft.com/mirror/quay/tigera/operator:v1.40.2|sha256:35f43a5fdc867629b3b8604f7fc8666e2f919778411d86adc6761b18f355e5f3
mcr.microsoft.com/mirror/quay/calico/node:v3.31.2|sha256:5255c2844abb4eea023cd15ceda5380d5bab3d5cf714fd113774597d2265f876
mcr.microsoft.com/mirror/quay/calico/typha:v3.31.2|sha256:f993b68a1d96f7072e0ec5ee6d0d3c9dce8fc37746ad160e262c8c753f6f9eb1
mcr.microsoft.com/mirror/quay/calico/kube-controllers:v3.31.2|sha256:7308b279c79816c9386a593644814a7f0f5caaf3b753982cbf226953782524ee

The `NodeImage` channel weekly rotation only replaces the underlying VM VHD; it does not change the tag pinned by the AKS control plane for these system-addon images. Only a new AKS 1.35.x patch that refreshes these component images can clear the finding.

## Request

Please ship a new AKS 1.35.x patch (and equivalent on any still-supported minor that also uses these tags) that includes:

1. `azure-cns` rebuilt against `golang.org/x/crypto >= 0.52.0` (the `Azure/azure-container-networking` `main` branch already carries a newer minor; a v1.8.x patch or a bump to the newer minor would work).
2. `tigera/operator` and the three `calico/*` images rebuilt against `golang.org/x/crypto >= 0.52.0`. This will most likely arrive when `tigera/operator` and `projectcalico/calico` cut new patches; a re-tag in the `mcr.microsoft.com/mirror/quay/...` mirror is what's ultimately needed on the AKS side.

If work is already in flight, a pointer to the target AKS release date would be very helpful for downstream planning.

## Real-world exploitability

None of these five binaries expose an SSH server that uses non-publickey callbacks, so the practical exploitability of CVE-2026-46595 in these images is effectively nil. The concern here is scanner hygiene / compliance: AKS-managed pods carry a CVSS-10 CVE that consumers cannot patch or override, and no in-place upgrade path currently clears it.

Thanks!