{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39832", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-04-07T18:13:03.529Z", "datePublished": "2026-05-22T02:31:26.660Z", "dateUpdated": "2026-06-30T03:16:05.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T02:31:26.660Z"}, "title": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent", "descriptions": [{"lang": "en", "value": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them."}], "affected": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh/agent", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/crypto/ssh/agent", "versions": [{"version": "0", "lessThan": "0.52.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "client.Add"}, {"name": "keyring.Add"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-281: Improper Preservation of Permissions"}]}], "references": [{"url": "https://go.dev/issue/79435"}, {"url": "https://go.dev/cl/778642"}, {"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5006"}], "credits": [{"lang": "en", "value": "NCC Group Cryptography Services, sponsored by Teleport"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-22T18:59:53.174504Z", "id": "CVE-2026-39832", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T19:03:06.882Z"}}, {"affected": [{"cpes": ["cpe:/a:redhat:assisted_installer:2"], "defaultStatus": "affected", "product": "Assisted Installer for Red Hat OpenShift Container Platform 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_builds:1"], "defaultStatus": "affected", "product": "Builds for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:external_secrets_operator:1"], "defaultStatus": "affected", "product": "External Secrets Operator for Red Hat OpenShift", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:multicluster_engine"], "defaultStatus": "affected", "product": "Multicluster Engine for Kubernetes", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:acm:2"], "defaultStatus": "affected", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:advanced_cluster_security:4"], "defaultStatus": "affected", "product": "Red Hat Advanced Cluster Security 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ceph_storage:9"], "defaultStatus": "affected", "product": "Red Hat Ceph Storage 9", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:edge_manager:1"], "defaultStatus": "affected", "product": "Red Hat Edge Manager 1", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4"], "defaultStatus": "affected", "product": "Red Hat Openshift Data Foundation 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:devworkspace"], "defaultStatus": "affected", "product": "Red Hat OpenShift Dev Workspaces Operator", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "defaultStatus": "affected", "product": "Red Hat OpenShift GitOps", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "defaultStatus": "affected", "product": "Red Hat OpenShift Virtualization 4", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "affected", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:quay:3"], "defaultStatus": "affected", "product": "Red Hat Quay 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:trusted_artifact_signer:1"], "defaultStatus": "affected", "product": "Red Hat Trusted Artifact Signer", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "unaffected", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}], "datePublic": "2026-05-22T02:31:26.660Z", "descriptions": [{"lang": "en", "value": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-281", "description": "Improper Preservation of Permissions", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-39832"}, {"name": "RHBZ#2480685", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json"}], "timeline": [{"lang": "en", "time": "2026-05-22T04:01:41.402Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-22T02:31:26.660Z", "value": "Made public."}], "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-06-30T03:16:05.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-22T18:59:53.174504Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-22T19:02:08.967Z"}}], "cna": {"title": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent", "credits": [{"lang": "en", "value": "NCC Group Cryptography Services, sponsored by Teleport"}], "affected": [{"vendor": "golang.org/x/crypto", "product": "golang.org/x/crypto/ssh/agent", "versions": [{"status": "affected", "version": "0", "lessThan": "0.52.0", "versionType": "semver"}], "packageName": "golang.org/x/crypto/ssh/agent", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "client.Add"}, {"name": "keyring.Add"}]}], "references": [{"url": "https://go.dev/issue/79435"}, {"url": "https://go.dev/cl/778642"}, {"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5006"}], "descriptions": [{"lang": "en", "value": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-281: Improper Preservation of Permissions"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T02:31:26.660Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39832", "state": "PUBLISHED", "dateUpdated": "2026-05-22T19:03:06.882Z", "dateReserved": "2026-04-07T18:13:03.529Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-05-22T02:31:26.660Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/crypto/ssh/agent", "product": "golang.org/x/crypto/ssh/agent", "programRoutines": [{"name": "client.Add"}, {"name": "keyring.Add"}], "vendor": "golang.org/x/crypto", "versions": [{"lessThan": "0.52.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*", "matchCriteriaId": "D540395B-31B8-4B07-8F79-F5C631BBD5C8", "versionEndExcluding": "0.52.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them."}], "id": "CVE-2026-39832", "lastModified": "2026-06-17T10:42:39.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39832", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-22T18:59:53.174504Z", "version": "2.0.3"}}]}, "published": "2026-05-22T04:16:22.663", "references": [{"source": "security@golang.org", "tags": ["Issue Tracking"], "url": "https://go.dev/cl/778642"}, {"source": "security@golang.org", "tags": ["Issue Tracking"], "url": "https://go.dev/issue/79435"}, {"source": "security@golang.org", "tags": ["Mailing List"], "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"}, {"source": "security@golang.org", "tags": ["Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2026-5006"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.52.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/crypto/ssh/agent", "source": "cna", "vendor": "golang.org/x/crypto"}, "product": "ssh", "vendor": "golang"}], "created": "2026-05-22T04:30:25.965866+00:00", "updated": "2026-05-28T19:45:25.033556+00:00", "vendors": ["golang", "golang$PRODUCT$ssh"]}