Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-39832

42
FAUCET Score

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

First published: May 22, 2026Last modified: May 22, 2026

Impacted Technologies

VendorProductVersion(s)CPE
< 0.52.0CPE matchmatch criteria
cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

CVSS Data

CVSS version used by this source: 3.1

9.1CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.60%
Probability of exploitation in next 30 days
EPSS Percentile
45.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0060 is in the 25th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

gopatch availablevia ghsa
Product: golang.org/x/cryptoFixed in: 0.52.0
microsoftpatch availablevia msrc
Product: azl3 docker-buildx 0.14.0-11 on Azure Linux 3.0Fixed in: 0.14.0-13
microsoftpatch availablevia msrc
Product: azl3 docker-compose 2.27.0-9 on Azure Linux 3.0Fixed in: 2.27.0-11
microsoftpatch availablevia msrc
Product: azl3 packer 1.9.5-13 on Azure Linux 3.0Fixed in: 1.9.5-14
microsoftpatch availablevia msrc
Product: azl3 telegraf 1.31.0-19 on Azure Linux 3.0Fixed in: 1.31.0-21
microsoftpatch availablevia msrc
Product: 21271-17084Fixed in: 0.14.0-13
microsoftpatch availablevia msrc
Product: 21272-17084Fixed in: 2.27.0-11
microsoftpatch availablevia msrc
Product: 20966-17084Fixed in: 1.9.5-14
microsoftpatch availablevia msrc
Product: 21258-17084Fixed in: 1.31.0-21

Vendor Advisories (2)

goGHSA-f5wc-c3c7-36mccritical

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

Jun 25, 2026
microsoft2026-May/CVE-2026-39832Important

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

May 12, 2026

References

access.redhat.com / errata/RHSA-2026:35833
access.redhat.com / errata/RHSA-2026:36199
access.redhat.com / errata/RHSA-2026:36319
access.redhat.com / errata/RHSA-2026:36625
access.redhat.com / errata/RHSA-2026:36648
access.redhat.com / errata/RHSA-2026:36651
access.redhat.com / errata/RHSA-2026:36796
access.redhat.com / errata/RHSA-2026:36797
access.redhat.com / errata/RHSA-2026:37072
access.redhat.com / errata/RHSA-2026:37123
access.redhat.com / errata/RHSA-2026:37271
access.redhat.com / errata/RHSA-2026:37387
access.redhat.com / errata/RHSA-2026:37410
access.redhat.com / errata/RHSA-2026:40118
access.redhat.com / errata/RHSA-2026:40262
access.redhat.com / errata/RHSA-2026:40945
access.redhat.com / errata/RHSA-2026:40972
access.redhat.com / errata/RHSA-2026:41019
access.redhat.com / errata/RHSA-2026:41031
access.redhat.com / errata/RHSA-2026:41036
access.redhat.com / errata/RHSA-2026:41066
access.redhat.com / errata/RHSA-2026:42146
access.redhat.com / errata/RHSA-2026:42796
access.redhat.com / errata/RHSA-2026:43052
access.redhat.com / errata/RHSA-2026:43692
access.redhat.com / security/cve/CVE-2026-39832
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-39832.json
go.dev / cl/778642
Issue Tracking
go.dev / issue/79435
Issue Tracking
groups.google.com / g/golang-announce/c/a082jnz-LvI
Mailing List
pkg.go.dev / vuln/GO-2026-5006
Vendor Advisory