The vulnerability CVE-2026-39833 affects the golang.org/x/crypto/ssh/agent package. The in-memory keyring returned by NewKeyring() accepted keys that had the ConfirmBeforeUse constraint but failed to enforce this constraint, allowing keys that should require user confirmation before use to sign operations silently. This is due to an improperly implemented security check for the ConfirmBeforeUse constraint. The NewKeyring() function has been updated to return an error when unsupported constraints are requested, but there is no confirmed official patch or remediation level from the vendor at this time.

This vulnerability allows an attacker to use keys that should require explicit user confirmation for signing operations without any prompt or indication, potentially leading to unauthorized cryptographic operations. The CVSS score of 9.1 reflects a critical severity with high confidentiality and integrity impact and no required privileges or user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The NewKeyring() function update to return an error on unsupported constraints suggests a potential mitigation path, but no official fix or remediation level has been confirmed by the vendor. Users should monitor the golang.org/x/crypto project advisories for updates.