CVE-2026-39833
In-Memory Keyring ConfirmBeforeUse Constraint Bypass
Publication date: 2026-05-22
Last updated on: 2026-05-22
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | to v0.52.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The vulnerability in CVE-2026-39833 involves the Go programming language's ssh agent package, specifically the NewKeyring() function. This function accepted keys that had the ConfirmBeforeUse constraint but did not enforce this constraint. As a result, keys could sign data without prompting for confirmation, and the caller would not be aware that the constraint was ignored.
The issue was fixed by changing NewKeyring() to return an error when unsupported constraints like ConfirmBeforeUse are requested, preventing silent acceptance without enforcement.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing cryptographic keys to sign data without any user confirmation, even if the keys are supposed to require confirmation before use. This could lead to unauthorized signing operations occurring silently, potentially compromising security by allowing actions that should require explicit approval to proceed without it.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the golang.org/x/crypto/ssh/agent package to version v0.52.0 or later, where the issue has been fixed.
The fix ensures that the NewKeyring() function returns an error when unsupported constraints like ConfirmBeforeUse are requested, preventing keys from signing without confirmation.