CVE-2026-39833: CWE-358: Improperly Implemented Security Check for Standard in golang.org/x/crypto golang.org/x/crypto/ssh/agent
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
AI Analysis
Technical Summary
The vulnerability in golang.org/x/crypto/ssh/agent involves improper enforcement of the ConfirmBeforeUse constraint in the in-memory keyring created by NewKeyring(). Keys with this constraint were accepted silently but the confirmation requirement was never enforced, allowing signing operations to proceed without user confirmation or notification. The fix involves NewKeyring() returning an error if unsupported constraints like ConfirmBeforeUse are requested, preventing silent acceptance of such keys.
Potential Impact
This vulnerability allows an attacker or malicious code to use keys that are supposed to require user confirmation for signing operations without any prompt or indication, potentially leading to unauthorized cryptographic operations and compromise of confidentiality and integrity. The CVSS score of 9.1 reflects the high impact on confidentiality and integrity with no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated that NewKeyring() now returns an error when unsupported constraints are requested, which suggests a fix is planned or implemented. Users should monitor official golang.org/x/crypto advisories for updates and apply any released patches promptly.
CVE-2026-39833: CWE-358: Improperly Implemented Security Check for Standard in golang.org/x/crypto golang.org/x/crypto/ssh/agent
Description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
CVSS v3.1
Score 9.1critical
Affected software
golang.org/x/crypto
golang.org/x/crypto/ssh/agent
pkg:golang/golang.org/x/crypto/ssh/agentpkg:golang/golang.org/x/crypto/ssh/agentRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in golang.org/x/crypto/ssh/agent involves improper enforcement of the ConfirmBeforeUse constraint in the in-memory keyring created by NewKeyring(). Keys with this constraint were accepted silently but the confirmation requirement was never enforced, allowing signing operations to proceed without user confirmation or notification. The fix involves NewKeyring() returning an error if unsupported constraints like ConfirmBeforeUse are requested, preventing silent acceptance of such keys.
Potential Impact
This vulnerability allows an attacker or malicious code to use keys that are supposed to require user confirmation for signing operations without any prompt or indication, potentially leading to unauthorized cryptographic operations and compromise of confidentiality and integrity. The CVSS score of 9.1 reflects the high impact on confidentiality and integrity with no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated that NewKeyring() now returns an error when unsupported constraints are requested, which suggests a fix is planned or implemented. Users should monitor official golang.org/x/crypto advisories for updates and apply any released patches promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Go
- Date Reserved
- 2026-04-07T18:13:03.529Z
- State
- PUBLISHED
Threat ID: 6a0fcdabe1370fbb487d501c
Added to database: 05/22/2026, 03:29:47 UTC
Last enriched: 08/12/2026, 13:19:23 UTC
Last updated: 09/14/2026, 22:01:33 UTC
Views: 197
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.