{"id":"CVE-2026-39832","title":"When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request","summary":"When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-502","CWE-281"],"vendor":"golang","product":"crypto","affected":["crypto < 0.52.0"],"patched":["crypto 0.52.0"],"published":"2026-05-22","updated":"2026-09-15","sourceUpdated":"2026-09-15T12:17:40.787","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39832","references":[{"url":"https://go.dev/cl/778640","label":"security@golang.org"},{"url":"https://go.dev/cl/778641","label":"security@golang.org"},{"url":"https://go.dev/issue/79435","label":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/a082jnz-LvI","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-5006","label":"security@golang.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:35833","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36199","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36319","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36625","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36648","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36797","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37072","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37123","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37271","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37410","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40972","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41019","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41036","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43692","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:49944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52857","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:52910","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57194","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59579","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:67450","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-39832","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480685","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39832"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39832"},{"url":"https://go.dev/cl/778642"},{"url":"https://github.com/advisories/GHSA-f5wc-c3c7-36mc"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","go","osv"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-05-22T18:59:53.174504Z"},"epss":0.006,"epssPercentile":0.47425,"ecosystem":"go","scores":{"nvd":9.1,"adp":9.1,"vendor":8.7,"ghsa":9.1},"ingestedAt":"2026-06-26T16:43:14.200Z","aliases":["GO-2026-5006","GHSA-f5wc-c3c7-36mc"],"slug":"CVE-2026-39832","body":"## Overview\n\nWhen adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.\n\n## Affected\n\n- `crypto < 0.52.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `crypto 0.52.0`\n\n## Package advisory (CVE-2026-39832)\n\nAffected packages:\n\n- `golang.org/x/crypto/ssh/agent < 0.52.0`\n\nPatched in:\n\n- `golang.org/x/crypto/ssh/agent 0.52.0`\n\nSource: https://github.com/advisories/GHSA-f5wc-c3c7-36mc\n\n## Vendor advisories\n\n- **RHSA-2026:41019** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41019)\n- **RHSA-2026:36796** · Red Hat · fixed in: RHEM 1.0 for RHEL 9 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36796)\n- **RHSA-2026:36199** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36199)\n- **RHSA-2026:37072** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37072)\n- **RHSA-2026:35833** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35833)\n- **RHSA-2026:49944** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:49944)\n- **RHSA-2026:37410** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37410)\n- **RHSA-2026:37123** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37123)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **RHSA-2026:43692** · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43692)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, cert-manager Operator for Red Hat OpenShift, External Secrets Operator for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat Advanced Cluster Management for Kubernetes 2, … · no fix planned: External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4, Red Hat Ceph Storage 9, Assisted Installer for Red Hat OpenShift Container Platform 2, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json)\n- **RHSA-2026:36319** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36319)\n- **RHSA-2026:67450** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67450)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":83254,"id":"CVE-2026-39832","ts":1789130377831,"field":"cvss","old":"8.7","new":"9.1"},{"seq":83253,"id":"CVE-2026-39832","ts":1789130377831,"field":"severity","old":"high","new":"critical"},{"seq":82394,"id":"CVE-2026-39832","ts":1789130152910,"field":"cvss","old":"9.1","new":"8.7"},{"seq":82393,"id":"CVE-2026-39832","ts":1789130152910,"field":"severity","old":"critical","new":"high"},{"seq":81335,"id":"CVE-2026-39832","ts":1789128317296,"field":"cvss","old":"8.7","new":"9.1"},{"seq":81334,"id":"CVE-2026-39832","ts":1789128317296,"field":"severity","old":"high","new":"critical"},{"seq":80284,"id":"CVE-2026-39832","ts":1789126409961,"field":"cvss","old":"9.1","new":"8.7"},{"seq":80283,"id":"CVE-2026-39832","ts":1789126409961,"field":"severity","old":"critical","new":"high"},{"seq":77200,"id":"CVE-2026-39832","ts":1789119561316,"field":"cvss","old":"8.7","new":"9.1"},{"seq":77199,"id":"CVE-2026-39832","ts":1789119561316,"field":"severity","old":"high","new":"critical"},{"seq":76180,"id":"CVE-2026-39832","ts":1789118638017,"field":"cvss","old":"9.1","new":"8.7"},{"seq":76179,"id":"CVE-2026-39832","ts":1789118638017,"field":"severity","old":"critical","new":"high"},{"seq":75136,"id":"CVE-2026-39832","ts":1789115074214,"field":"cvss","old":"8.7","new":"9.1"},{"seq":75135,"id":"CVE-2026-39832","ts":1789115074214,"field":"severity","old":"high","new":"critical"},{"seq":74080,"id":"CVE-2026-39832","ts":1789111363291,"field":"cvss","old":"9.1","new":"8.7"},{"seq":74079,"id":"CVE-2026-39832","ts":1789111363291,"field":"severity","old":"critical","new":"high"},{"seq":73028,"id":"CVE-2026-39832","ts":1789110288585,"field":"cvss","old":"8.7","new":"9.1"},{"seq":73027,"id":"CVE-2026-39832","ts":1789110288585,"field":"severity","old":"high","new":"critical"},{"seq":71970,"id":"CVE-2026-39832","ts":1789107436133,"field":"cvss","old":"9.1","new":"8.7"},{"seq":71969,"id":"CVE-2026-39832","ts":1789107436133,"field":"severity","old":"critical","new":"high"},{"seq":70912,"id":"CVE-2026-39832","ts":1789105847208,"field":"cvss","old":"8.7","new":"9.1"},{"seq":70911,"id":"CVE-2026-39832","ts":1789105847208,"field":"severity","old":"high","new":"critical"},{"seq":69854,"id":"CVE-2026-39832","ts":1789103579521,"field":"cvss","old":"9.1","new":"8.7"},{"seq":69853,"id":"CVE-2026-39832","ts":1789103579521,"field":"severity","old":"critical","new":"high"},{"seq":68796,"id":"CVE-2026-39832","ts":1789101514575,"field":"cvss","old":"8.7","new":"9.1"},{"seq":68795,"id":"CVE-2026-39832","ts":1789101514575,"field":"severity","old":"high","new":"critical"},{"seq":67737,"id":"CVE-2026-39832","ts":1789099715596,"field":"cvss","old":"9.1","new":"8.7"},{"seq":67736,"id":"CVE-2026-39832","ts":1789099715596,"field":"severity","old":"critical","new":"high"},{"seq":44588,"id":"CVE-2026-39832","ts":1789044560487,"field":"cvss","old":"8.7","new":"9.1"},{"seq":44587,"id":"CVE-2026-39832","ts":1789044560487,"field":"severity","old":"high","new":"critical"},{"seq":43873,"id":"CVE-2026-39832","ts":1789043248289,"field":"cvss","old":"9.1","new":"8.7"},{"seq":43872,"id":"CVE-2026-39832","ts":1789043248289,"field":"severity","old":"critical","new":"high"},{"seq":43113,"id":"CVE-2026-39832","ts":1789041622069,"field":"cvss","old":"8.7","new":"9.1"},{"seq":43112,"id":"CVE-2026-39832","ts":1789041622069,"field":"severity","old":"high","new":"critical"},{"seq":42353,"id":"CVE-2026-39832","ts":1789039487904,"field":"cvss","old":"9.1","new":"8.7"},{"seq":42352,"id":"CVE-2026-39832","ts":1789039487904,"field":"severity","old":"critical","new":"high"},{"seq":41593,"id":"CVE-2026-39832","ts":1789037486067,"field":"cvss","old":"8.7","new":"9.1"},{"seq":41592,"id":"CVE-2026-39832","ts":1789037486067,"field":"severity","old":"high","new":"critical"},{"seq":41077,"id":"CVE-2026-39832","ts":1789035723101,"field":"cvss","old":"9.1","new":"8.7"},{"seq":41076,"id":"CVE-2026-39832","ts":1789035723101,"field":"severity","old":"critical","new":"high"},{"seq":40073,"id":"CVE-2026-39832","ts":1789033346380,"field":"cvss","old":"8.7","new":"9.1"},{"seq":40072,"id":"CVE-2026-39832","ts":1789033346380,"field":"severity","old":"high","new":"critical"},{"seq":39314,"id":"CVE-2026-39832","ts":1789029760979,"field":"cvss","old":"9.1","new":"8.7"},{"seq":39313,"id":"CVE-2026-39832","ts":1789029760979,"field":"severity","old":"critical","new":"high"},{"seq":38557,"id":"CVE-2026-39832","ts":1789029237286,"field":"cvss","old":"8.7","new":"9.1"},{"seq":38556,"id":"CVE-2026-39832","ts":1789029237286,"field":"severity","old":"high","new":"critical"},{"seq":37800,"id":"CVE-2026-39832","ts":1789025877920,"field":"cvss","old":"9.1","new":"8.7"},{"seq":37799,"id":"CVE-2026-39832","ts":1789025877920,"field":"severity","old":"critical","new":"high"},{"seq":37043,"id":"CVE-2026-39832","ts":1789025131944,"field":"cvss","old":"8.7","new":"9.1"},{"seq":37042,"id":"CVE-2026-39832","ts":1789025131944,"field":"severity","old":"high","new":"critical"}]}