EUVD-2026-31389CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionNVD
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
AnalysisAI
Authentication bypass in Go's golang.org/x/crypto/ssh/agent in-memory keyring (versions before 0.52.0) allows SSH key signing operations to proceed without the intended ConfirmBeforeUse user confirmation prompt. Applications that relied on this constraint to gate sensitive signing actions effectively had no protection, with no error returned to indicate the constraint was silently ignored. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Conduct inventory of all Go applications using golang.org/x/crypto/ssh/agent dependency and document current versions in use. Within 7 days: Upgrade golang.org/x/crypto/ssh/agent to version 0.52.0 or later in all affected applications, rebuild, and stage for production deployment. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today