CVE-2026-39833 Details
Description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
A vulnerability exists in the in-memory keyring provided by the Golang crypto package's SSH agent. The NewKeyring() function accepted keys with the ConfirmBeforeUse constraint but failed to enforce it, allowing keys to sign without confirmation. This issue has been addressed in version v0.52.0, where NewKeyring() now returns an error for unsupported constraints.
Users can update to version v0.52.0 of the Golang crypto package to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/778642 | [email protected] | |
| https://go.dev/issue/79436 | [email protected] | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/a082jnz-LvI | [email protected] | Mailing List |
| https://pkg.go.dev/vuln/GO-2026-5005 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| golang crypto | < 0.52.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 22, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |