Vulnerabilities CVE-2026-39833

CVE-2026-39833

None

Open

TLP:CLEAR

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Details

EPSS Score ⓘ: 0.41%

34.1th percentile
Confidence: 90%
Published: May 22, 2026
Last Modified: Aug 11, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.