CVEvulnerability
CVE-2026-39833
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2026-05-22
- Last modified
- 2026-08-11
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-862
Description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Affected configurations
• golang crypto (< 0.52.0)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://go.dev/cl/778642 go.dev
- https://go.dev/issue/79436 Issue Tracking
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI Mailing List
- https://pkg.go.dev/vuln/GO-2026-5005 Vendor Advisory