What is the CVSS score of CVE-2026-39832?

CVE-2026-39832 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of golang.org/x/crypto are affected by CVE-2026-39832?

golang.org/x/crypto SSH agent client versions prior to 0.52.0 silently strip destination restrictions from forwarded SSH keys, effectively converting scoped credentials into unrestricted ones on…. A patch is available.

Is there a public PoC exploit available for CVE-2026-39832?

Yes, a public proof-of-concept exploit is available for CVE-2026-39832. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-39832?

Within 24 hours: Inventory all applications and Go modules using golang.org/x/crypto and identify those used in SSH key forwarding scenarios. Within 7 days: Update to golang.org/x/crypto 0.52.0 or later and rebuild all affected applications and binaries. Within 30 days: Verify deployment of patched versions across all production systems and conduct a comprehensive SSH key audit to identify any improperly scoped forwarded keys.

golang.org/x/crypto CVE-2026-39832

EUVD-2026-31390 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-22 Go

GHSA-f5wc-c3c7-36mc

SSH Deserialization Golang Org X Crypto Ssh Agent

9.1

CVSS 3.1 · Vendor: Go

Severity by source

Vendor (Go) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 15:22 vuln.today

CVSS changed

May 28, 2026 - 15:22 NVD

9.1 (None) 9.1 (CRITICAL)

Patch available

May 22, 2026 - 04:31 EUVD

CVE Published

May 22, 2026 - 02:31 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

AnalysisAI

Constraint extension stripping in the golang.org/x/crypto SSH agent client (versions prior to 0.52.0) allows remote SSH hosts to use forwarded keys without the destination restrictions the user intended. When clients added keys to a remote agent, extensions such as restrict-destination-v00@openssh.com were silently dropped during serialization, effectively converting scoped keys into unrestricted ones on downstream hosts. No public exploit identified at time of analysis and EPSS is very low (0.02%), but SSVC rates technical impact as total and automatable.

Technical ContextAI

The flaw resides in the SSH agent client implementation under golang.org/x/crypto/ssh/agent, a Go package widely embedded in SSH tooling, CI runners, bastions, and orchestration agents that need to forward keys. The Add code path failed to serialize SSH agent protocol constraint extensions (notably the OpenSSH restrict-destination-v00@openssh.com extension defined to bind a key to specific hop/host pairs) when sending the SSH_AGENTC_ADD_ID_CONSTRAINED message to a remote agent. Although tagged with CWE-502 (Deserialization of Untrusted Data) and the 'Deserialization' tag, the root cause is more accurately a serialization omission: constraint TLV blobs were not written into the request, so the remote agent received an unconstrained key. The companion fix also hardens the in-memory NewKeyring() to reject unknown constraint extensions rather than silently honoring keys as unrestricted.

RemediationAI

Vendor-released patch: golang.org/x/crypto v0.52.0 - upgrade the module via 'go get golang.org/x/crypto@v0.52.0' and rebuild all affected binaries, then redeploy (Go vulnerabilities are not fixed by runtime updates because the library is statically linked). Track the fix via the upstream change at https://go.dev/cl/778642, the announcement at https://groups.google.com/g/golang-announce/c/a082jnz-LvI, and the Go vulnerability database entry at https://pkg.go.dev/vuln/GO-2026-5006. As an interim compensating control until binaries are rebuilt, disable agent forwarding to untrusted hosts (ForwardAgent no in ssh_config and remove ssh -A invocations), or stop relying on destination restrictions and instead use short-lived signed certificates or per-host keys so that a stripped-constraint key still has limited blast radius; note this trade-off increases operational overhead but is the only effective workaround since the client silently misbehaves and cannot be reconfigured.