CVE-2026-39833

CRITICAL9.1

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

Published May 22, 2026

Modified 1 weeks ago

Details

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

References

WEB

https://go.dev/cl/778640

WEB

https://go.dev/cl/778641

WEB

https://go.dev/issue/79436

WEB

https://groups.google.com/g/golang-announce/c/a082jnz-LvI

WEB

https://pkg.go.dev/vuln/GO-2026-5005

ADVISORY