CVE-2026-39833Medium· 5.5▾ Sunlit

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 30.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 22, 2026

Updated

Sep 10, 2026

CVSS

5.5

Vendor

Red Hat

Product

Red Hat OpenShift Container Platform 4

CWE

CWE-358, CWE-862

Depth score

30 · Low

EPSS

0.41% · p35

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Scores by source

GitHub 9.1 · Vendor 5.5⚖ 3.6-point dispute

EPSS history

Exploit-prediction probability, daily snapshots since Jul 4.

0.4% → 0.4%▲ 0.05%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

16 events · 116 days

May 22, 2026Published
Disclosed via CSAF
Jul 4, 2026EPSS first tracked
0.4%
Jul 24, 2026EPSS peak
0.4% → 0.4%
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 14, 2026CVSS changed
5.5 → 9.1
Sep 14, 2026Severity changed
medium → critical
Sep 14, 2026CVSS changed
9.1 → 5.5
Sep 14, 2026Severity changed
critical → medium
Sep 14, 2026CVSS changed
5.5 → 9.1
Sep 14, 2026Severity changed
medium → critical
Sep 14, 2026CVSS changed
9.1 → 5.5
Sep 14, 2026Severity changed
critical → medium
Sep 14, 2026CVSS changed
5.5 → 9.1
Sep 14, 2026Severity changed
medium → critical
Sep 14, 2026CVSS changed
9.1 → 5.5
Sep 14, 2026Severity changed
critical → medium

Red Hat CWE-358 CWE-862 #csaf #vex #red-hat #ghsa #go #score-dispute

Affected

Patched in

openshift_api_for_data_protection 1.5
openshift_api_for_data_protection 1.6
openshift_builds 1.7.3
openshift_builds 1.8.1
openshift_data_foundation 4.22
trusted_artifact_signer 1.4
multicluster_engine_for_kubernetes 2.11

Full technical detail▾

Overview

A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before use to perform signing operations without any prompt or indication to the user. Consequently, an attacker could potentially bypass intended security controls, leading to unauthorized cryptographic signing actions.

Vendor advisories

RHSA-2026:66022 · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · advisory
RHSA-2026:43692 · Red Hat · fixed in: OpenShift API for Data Protection 1.6 · released 2026-07-22 · advisory
RHSA-2026:36648 · Red Hat · fixed in: Red Hat OpenShift Builds 1.7.3 · released 2026-07-08 · advisory
RHSA-2026:41036 · Red Hat · fixed in: Red Hat OpenShift Builds 1.8.1 · released 2026-07-16 · advisory
RHSA-2026:37387 · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-07-09 · advisory
RHSA-2026:36797 · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.4 · released 2026-07-08 · advisory
RHSA-2026:37271 · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.4 · released 2026-07-09 · advisory
RHSA-2026:57194 · Red Hat · fixed in: multicluster engine for Kubernetes 2.11 · released 2026-08-19 · advisory
Red Hat VEX · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, Deployment Validation Operator, … · no fix planned: Red Hat Trusted Artifact Signer, Assisted Installer for Red Hat OpenShift Container Platform 2, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, … · updated 2026-09-10 · vex

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation — rated Moderate by Red Hat. Released 2026-05-22, updated 2026-09-10.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
Exploit Intelligence
External Secrets Operator for Red Hat OpenShift
ExternalDNS Operator
File Integrity Operator
Gatekeeper 3
Job Set 1
Job Set Tech Preview
Kernel Module Management Operator for Red Hat Openshift
Kube Descheduler Operator
Leader Worker Set
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
MCP Server for Red Hat OpenShift
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Migration Toolkit for Virtualization
Multiarch Tuning Operator
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
Node HealthCheck Operator
OpenShift API for Data Protection
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Run Once Duration Override Operator
OpenShift Secondary Scheduler Operator
OpenShift Serverless
OpenShift Service Mesh 2
OpenShift Service Mesh 3
Pen Drive Powered by Red Hat Lightspeed
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2

Fixed:

OpenShift API for Data Protection 1.5
OpenShift API for Data Protection 1.6
Red Hat OpenShift Builds 1.7.3
Red Hat OpenShift Builds 1.8.1
Red Hat Openshift Data Foundation 4.22
Red Hat Trusted Artifact Signer 1.4
multicluster engine for Kubernetes 2.11

No fix planned:

Red Hat Trusted Artifact Signer
Assisted Installer for Red Hat OpenShift Container Platform 2
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Cryostat 4
Custom Metric Autoscaler operator for Red Hat Openshift
Deployment Validation Operator
Exploit Intelligence
External Secrets Operator for Red Hat OpenShift
ExternalDNS Operator
File Integrity Operator
Gatekeeper 3
Job Set 1
Job Set Tech Preview
Kernel Module Management Operator for Red Hat Openshift
Kube Descheduler Operator
Leader Worker Set
Logging Subsystem for Red Hat OpenShift
Logical Volume Manager Storage
MCP Server for Red Hat OpenShift
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Migration Toolkit for Virtualization
Multiarch Tuning Operator
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
Node HealthCheck Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Run Once Duration Override Operator
OpenShift Secondary Scheduler Operator
OpenShift Serverless
OpenShift Service Mesh 2
OpenShift Service Mesh 3
Pen Drive Powered by Red Hat Lightspeed
Power monitoring for Red Hat OpenShift
Red Hat 3scale API Management Platform 2
Red Hat Advanced Cluster Management for Kubernetes 2

Not affected:

OpenShift API for Data Protection 1.5
OpenShift API for Data Protection 1.6
Red Hat OpenShift Builds 1.7.3
Red Hat OpenShift Builds 1.8.1
Red Hat Openshift Data Foundation 4.22
Red Hat Trusted Artifact Signer 1.4
Compliance Operator
multicluster engine for Kubernetes 2.11
Multicluster Engine for Kubernetes
OpenShift Lightspeed

Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:66022 Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43692 It is recommended that existing users of Red Hat OpenShift Builds 1.7.3 upgrade to 1.7.4 https://access.redhat.com/errata/RHSA-2026:36648

Workarounds / mitigations:

Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use.

Package advisory (CVE-2026-39833)

Affected packages:

golang.org/x/crypto/ssh/agent < 0.52.0

Patched in:

golang.org/x/crypto/ssh/agent 0.52.0

Source: https://github.com/advisories/GHSA-jppx-rxg9-jmrx

References

Change history

Field changes observed since this record was first indexed.

Sep 14, 2026CVSS 9.1 → 5.5
Sep 14, 2026Severity critical → medium
Sep 14, 2026CVSS 5.5 → 9.1
Sep 14, 2026Severity medium → critical
Sep 14, 2026CVSS 9.1 → 5.5
Sep 14, 2026Severity critical → medium
Sep 14, 2026CVSS 5.5 → 9.1
Sep 14, 2026Severity medium → critical
Sep 14, 2026CVSS 9.1 → 5.5
Sep 14, 2026Severity critical → medium
Sep 14, 2026CVSS 5.5 → 9.1
Sep 14, 2026Severity medium → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#ghsa#go#score-dispute

← Back to feed