CVE-2026-39833

9.1 Critique

Publiée le 22/05/2026 à 06:16 · Modifiée le 12/08/2026 à 00:17 · Modifiée · Source : security@golang.org

Description

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Traduire en français

Produits concernés

golang.org/x/crypto/ssh/agent
Golang crypto

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-862

Références

https://go.dev/cl/778642
https://go.dev/issue/79436 Issue Tracking
https://groups.google.com/g/golang-announce/c/a082jnz-LvI Mailing List
https://pkg.go.dev/vuln/GO-2026-5005 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories