CVE-2026-39831
Unattended Signature Acceptance in OpenSSH Security Keys
Publication date: 2026-05-22
Last updated on: 2026-05-22
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | to v0.52.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability allows signatures to be generated without the user's physical interaction with the hardware security key, enabling unattended use.
This could lead to unauthorized access or actions being performed using the security key without the user's consent or knowledge.
Can you explain this vulnerability to me?
This vulnerability affects the Verify() method for FIDO/U2F security key types in the Go SSH package. It fails to check the User Presence flag, which means signatures can be generated and accepted without requiring the user to physically touch the hardware security key.
As a result, an attacker or automated process could use the hardware security key unattended, bypassing the intended physical confirmation step.
To restore the intended security behavior, the "no-touch-required" extension must be returned in Permissions.Extensions from PublicKeyCallback.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves the acceptance of signatures generated without physical touch on FIDO/U2F security keys in the Go SSH package. Detection would involve verifying whether the affected Go package golang.org/x/crypto/ssh is in use and if it is a version before v0.52.0.
Since the issue is related to the Verify() method not checking the User Presence flag, detection could include monitoring SSH authentication logs for unusual or unattended hardware security key usage.
No specific commands for detection are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the golang.org/x/crypto/ssh package to version v0.52.0 or later where the issue is fixed.
Ensure that the Verify() method returns the "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback to restore the previous behavior requiring physical touch for signature generation.
Review and update any affected symbols such as CertChecker.Authenticate, CertChecker.CheckCert, CertChecker.CheckHostKey, Certificate.Verify, Dial, NewClientConn, and NewServerConn as part of the update.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows signatures to be generated without requiring physical user presence or touch on FIDO/U2F security keys, enabling unattended use of hardware security keys.
Such a flaw could potentially weaken authentication controls that are critical for compliance with standards and regulations like GDPR and HIPAA, which require strong user authentication and protection of sensitive data.
By allowing unattended use of hardware security keys, the vulnerability may increase the risk of unauthorized access, thereby impacting the security posture required by these regulations.