CVE-2026-39833

Summary

golang.org/x/crypto/ssh/agent doesn't enforce invoking key constraints

Severity

critical

CVSS

9.1

EPSS

0.4% (p35)

CWE

CWE-862

Also known as

GHSA-jppx-rxg9-jmrx, GO-2026-5005

Published

2026-06-25

Updated

2026-06-25

Advisory details

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

References

• https://github.com/advisories/GHSA-jppx-rxg9-jmrx
• https://nvd.nist.gov/vuln/detail/CVE-2026-39833
• https://go.dev/cl/778640
• https://go.dev/cl/778641
• https://go.dev/issue/79436
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5005

Related advisories

• CVE-2026-39832 — critical · Go/golang.org/x/crypto/ssh/agent
• CVE-2026-46598 — medium · Go/golang.org/x/crypto/ssh/agent
• CVE-2026-73842 — critical · Go/github.com/openchoreo/openchoreo
• CVE-2026-73843 — critical · Go/github.com/openchoreo/openchoreo
• CVE-2026-54569 — critical · PyPI/senaite.core
• CVE-2026-54523 — critical · Go/github.com/kyverno/kyverno
• GHSA-rjg6-39jm-rgg4 — critical · npm/@better-auth/scim
• GHSA-p63j-vcc4-9vmv — critical · npm/@vitest/browser

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity