CVE-2026-39832criticalCWE-281

CVE-2026-39832: falha crítica em golang.org/x/crypto/ssh/agent

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Publicada em 22 mai 2026 · Atualizada em 15 set 2026

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.7%

probabilidade de exploração

0.7%top 48% das CVEs

exploração observada

nãonenhuma fonte reporta

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Produtos afetados

golang.org/x/crypto · golang.org/x/crypto/ssh/agent

CVEs relacionadas — golang.org/x/crypto/ssh/agent

No mesmo produto, das mais perigosas para as menos.

CVE-2025-47913HIGHPotential denial of service in golang.org/x/crypto/ssh/agentEPSS 0.7%CVE-2025-47914MEDIUMMalformed constraint may cause denial of service in golang.org/x/crypto/ssh/agentEPSS 0.5%CVE-2026-39833CRITICALInvoking key constraints not enforced in golang.org/x/crypto/ssh/agentEPSS 0.5%CVE-2026-46598MEDIUMInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agentEPSS 0.4%

Referências