This vulnerability involves improper preservation of permissions (CWE-281) in the golang.org/x/crypto/ssh/agent package. When keys were added to a remote agent, constraint extensions that restrict key usage destinations were not serialized in the request, resulting in these restrictions being silently removed during key forwarding. This flaw could allow forwarded keys to be used without the intended destination restrictions. The fix involves serializing all constraint extensions and rejecting keys with unsupported constraints in the in-memory keyring returned by NewKeyring().

The impact is that keys forwarded to remote agents could be used without the intended destination restrictions, potentially allowing broader key usage than intended on remote hosts. This could lead to unauthorized use of SSH keys in environments relying on these constraints. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that the client now serializes all constraint extensions and rejects unsupported keys, implying a fix has been implemented in the codebase. Users should update to the fixed version once available. Until then, be cautious with key forwarding and monitor for updates from the golang.org/x/crypto project.