Critical severity · published May 22, 2026
CVE-2026-39833
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/crypto/ssh/agent · golang.org/x/crypto
before 0.52.0 · source: vendor
CR
Crypto · Golang
before 0.52.0 · source: NVD
Affected product
GO
golang.org/x/crypto/ssh/agent
golang.org/x/crypto
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39833
go.dev
https://go.dev/cl/778642
Issue Tracking
https://go.dev/issue/79436
Mailing List
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-5005
More from golang.org/x/crypto/ssh/agent
9.1
CVE-2026-39832
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
5.3
CVE-2026-46598
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent