Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
cve-program · CVE-2026-39833
PublishedThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Read the publisher's advisoryeuvd · EUVD-2026-31389
PublishedThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Read the publisher's advisorynvd · CVE-2026-39833
PublishedThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Read the publisher's advisoryosv · GHSA-jppx-rxg9-jmrx
PublishedThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Read the publisher's advisoryosv · GO-2026-5005
PublishedThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-39833 · CVE overview and exploitation status
cve-program · CVE-2026-39833
- https://go.dev/issue/79436
- https://go.dev/cl/778642
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5005
euvd · EUVD-2026-31389
- https://go.dev/issue/79436
- https://go.dev/cl/778642
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5005
nvd · CVE-2026-39833
- https://go.dev/cl/778642
- https://go.dev/issue/79436
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5005
osv · GHSA-jppx-rxg9-jmrx
- https://nvd.nist.gov/vuln/detail/CVE-2026-39833
- https://cs.opensource.google/go/x/crypto
- https://go.dev/cl/778640
- https://go.dev/cl/778641
- https://go.dev/issue/79436
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI
- https://pkg.go.dev/vuln/GO-2026-5005