CVEvulnerability

CVE-2026-39832

9.1 CRITICAL Published 2026-05-22 Modified 2026-09-15 Official page ↗
Status
Modified
Published
2026-05-22
Last modified
2026-09-15
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
8.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-281, CWE-502

Description

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Affected configurations

• golang crypto (< 0.52.0)

Related

Weakness · CWE (2)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References