CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
Other sources
When adding a key to a remote agent constraint extensions such as restrict-destination-v00 were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
— Red Hat
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/golang.org/x/crypto/ssh/agentto a version that resolves this vulnerability.Fixed in 0.52.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39832?
CVE-2026-39832 has a risk rating of 53.
How do I fix CVE-2026-39832?
To fix CVE-2026-39832, update to the latest version of golang.org/x/crypto/ssh/agent where the issue is addressed.
What impact does CVE-2026-39832 have on key forwarding?
CVE-2026-39832 allows for destination restrictions to be stripped, enabling unrestricted use of forwarded keys on remote hosts.
Which software is affected by CVE-2026-39832?
CVE-2026-39832 affects the golang.org/x/crypto/ssh/agent software.
When was CVE-2026-39832 published?
CVE-2026-39832 was published on May 22, 2026.