{"api_version":"1","generated_at":"2026-05-28T16:29:24+00:00","cve":"CVE-2026-39833","urls":{"html":"https://cve.report/CVE-2026-39833","api":"https://cve.report/api/cve/CVE-2026-39833.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-39833","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-39833"},"summary":{"title":"Invoking  key constraints not enforced in golang.org/x/crypto/ssh/agent","description":"The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.","state":"PUBLISHED","assigner":"Go","published_at":"2026-05-22 04:16:22","updated_at":"2026-05-28 15:04:39"},"problem_types":["CWE-862","CWE-358: Improperly Implemented Security Check for Standard"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}}],"references":[{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","name":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","refsource":"security@golang.org","tags":["Mailing List"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://go.dev/issue/79436","name":"https://go.dev/issue/79436","refsource":"security@golang.org","tags":["Issue Tracking"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://pkg.go.dev/vuln/GO-2026-5005","name":"https://pkg.go.dev/vuln/GO-2026-5005","refsource":"security@golang.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://go.dev/cl/778640","name":"https://go.dev/cl/778640","refsource":"security@golang.org","tags":["Issue Tracking"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://go.dev/cl/778641","name":"https://go.dev/cl/778641","refsource":"security@golang.org","tags":["Issue Tracking"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39833","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39833","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"golang.org/x/crypto","product":"golang.org/x/crypto/ssh/agent","version":"affected 0.52.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"NCC Group Cryptography Services, sponsored by Teleport","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"39833","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"golang","cpe5":"crypto","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"go","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"39833","cve":"CVE-2026-39833","epss":"0.000330000","percentile":"0.100710000","score_date":"2026-05-27","updated_at":"2026-05-28 00:02:13"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-39833","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-22T18:57:41.103317Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-05-22T18:58:08.489Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"golang.org/x/crypto/ssh/agent","product":"golang.org/x/crypto/ssh/agent","programRoutines":[{"name":"keyring.Add"}],"vendor":"golang.org/x/crypto","versions":[{"lessThan":"0.52.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","value":"NCC Group Cryptography Services, sponsored by Teleport"}],"descriptions":[{"lang":"en","value":"The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested."}],"problemTypes":[{"descriptions":[{"description":"CWE-358: Improperly Implemented Security Check for Standard","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-05-22T02:31:26.294Z","orgId":"1bb62c36-49e3-4200-9d77-64a1400537cc","shortName":"Go"},"references":[{"url":"https://go.dev/issue/79436"},{"url":"https://go.dev/cl/778640"},{"url":"https://go.dev/cl/778641"},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI"},{"url":"https://pkg.go.dev/vuln/GO-2026-5005"}],"title":"Invoking  key constraints not enforced in golang.org/x/crypto/ssh/agent"}},"cveMetadata":{"assignerOrgId":"1bb62c36-49e3-4200-9d77-64a1400537cc","assignerShortName":"Go","cveId":"CVE-2026-39833","datePublished":"2026-05-22T02:31:26.294Z","dateReserved":"2026-04-07T18:13:03.529Z","dateUpdated":"2026-05-22T18:58:08.489Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-22 04:16:22","lastModifiedDate":"2026-05-28 15:04:39","problem_types":["CWE-862","CWE-358: Improperly Implemented Security Check for Standard"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*","versionEndExcluding":"0.52.0","matchCriteriaId":"D540395B-31B8-4B07-8F79-F5C631BBD5C8"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"39833","Ordinal":"1","Title":"Invoking  key constraints not enforced in golang.org/x/crypto/ss","CVE":"CVE-2026-39833","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"39833","Ordinal":"1","NoteData":"The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.","Type":"Description","Title":"Invoking  key constraints not enforced in golang.org/x/crypto/ss"}]}}}