CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
Other sources
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-go.cryptoto a version that resolves this vulnerability.Fixed in 1:0.53.0-1 - Upgrade
Upgrade
go/golang.org/x/crypto/ssh/agentto a version that resolves this vulnerability.Fixed in 0.52.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.0-23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.27.0-13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.5-16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.14.0-15
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39833?
CVE-2026-39833 has a risk rating of 37 indicating a moderate severity level.
How do I fix CVE-2026-39833?
To fix CVE-2026-39833, update to the latest version of golang.org/x/crypto/ssh/agent where the enforcement of key constraints has been improved.
What does CVE-2026-39833 affect?
CVE-2026-39833 affects the NewKeyring() function in golang.org/x/crypto/ssh/agent that mishandles the ConfirmBeforeUse key constraint.
What happens if I use NewKeyring() without applying the fix for CVE-2026-39833?
Using NewKeyring() without applying the fix for CVE-2026-39833 may lead to unintended key operations without user confirmation.
Who should be concerned about CVE-2026-39833?
Developers and organizations using golang.org/x/crypto/ssh/agent should be aware of CVE-2026-39833 and implement the necessary updates to mitigate security risks.