What is the CVSS score of EUVD-2026-31390?

EUVD-2026-31390 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-31390?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31390. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31390?

Within 24 hours: Inventory all applications and Go modules using golang.org/x/crypto and identify those used in SSH key forwarding scenarios. Within 7 days: Update to golang.org/x/crypto 0.52.0 or later and rebuild all affected applications and binaries. Within 30 days: Verify deployment of patched versions across all production systems and conduct a comprehensive SSH key audit to identify any improperly scoped forwarded keys.

golang.org/x/crypto EUVD-2026-31390

Q: Which versions of golang.org/x/crypto are affected by EUVD-2026-31390?

golang.org/x/crypto SSH agent client versions prior to 0.52.0 silently strip destination restrictions from forwarded SSH keys, effectively converting scoped credentials into unrestricted ones on…. A patch is available.

| CVE-2026-39832 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-22 Go

GHSA-f5wc-c3c7-36mc

Deserialization SSH Golang Org X Crypto Ssh Agent Golang Org X Crypto

9.1

CVSS 3.1 · Vendor: Go

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Compromise intermediate SSH host
Delivery

Victim forwards constraint-bound key via vulnerable Go client
Exploit

Constraint extensions stripped during agent Add
Execution

Malicious agent receives unrestricted key
Persist

Attacker authenticates to out-of-scope downstream hosts
Impact

Lateral movement using stolen trust

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to be forwarding an SSH agent key that carries OpenSSH constraint extensions (specifically restrict-destination-v00@openssh.com or similar) to a remote agent that the attacker controls or has compromised - typically a bastion, jump host, CI runner, or container using a Go-based SSH client built against golang.org/x/crypto/ssh/agent < 0.52.0. Limiting factors: the attacker must already control or sit on a host in the SSH forwarding chain (no direct internet exploitation path), the victim must use destination-restricted keys (a relatively advanced OpenSSH 8.9+ feature most users do not configure), and the impact is bounded to whatever downstream hosts the unrestricted key can reach. Environments using only stock OpenSSH agent without destination restrictions, or not using Go-based SSH clients, are unaffected.
Impact	The CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) reflects the worst-case scenario where a forwarded key grants attackers on a compromised intermediate host full reuse of credentials that the user believed were restricted, yielding high confidentiality and integrity impact across downstream systems. However, this rating is somewhat misleading in isolation: real-world exploitation requires the victim to be actively forwarding a constraint-protected key to an attacker-controlled or compromised agent, and EPSS is only 0.02% (4th percentile) with CISA SSVC marking Exploitation as 'none' - consistent with 'no public exploit identified at time of analysis.' SSVC nonetheless flags Automatable=yes and Technical Impact=total, meaning that once a malicious agent is in the path, abuse is trivial and complete. Net assessment: prioritize patching environments that rely on destination-restricted agent forwarding (bastions, CI, jump hosts), but this is not a drive-by internet-facing RCE; the PR:N rating applies to the remote SSH server side, not to gaining initial access.
Exploit ScenarioDerived	A user runs an SSH client built on golang.org/x/crypto/ssh/agent and forwards an agent key bound by restrict-destination-v00 to host A only, then connects through a multi-hop session that passes through compromised bastion B. Because the client never serializes the destination constraint when adding the key to B's agent, an attacker on B uses the forwarded key to authenticate to arbitrary downstream hosts the user never intended to authorize. No public proof-of-concept has been identified, but exploitation is straightforward once a malicious agent is on path and SSVC marks the attack as automatable.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 28, 2026

Constraint extension stripping in the golang.org/x/crypto SSH agent client (versions prior to 0.52.0) allows remote SSH hosts to use forwarded keys without the destination restrictions the user intended. When clients added keys to a remote agent, extensions such as restrict-destination-v00@openssh.com were silently dropped during serialization, effectively converting scoped keys into unrestricted ones on downstream hosts. No public exploit identified at time of analysis and EPSS is very low (0.02%), but SSVC rates technical impact as total and automatable.

RemediationAI

Vendor-released patch: golang.org/x/crypto v0.52.0 - upgrade the module via 'go get golang.org/x/crypto@v0.52.0' and rebuild all affected binaries, then redeploy (Go vulnerabilities are not fixed by runtime updates because the library is statically linked). Track the fix via the upstream change at https://go.dev/cl/778642, the announcement at https://groups.google.com/g/golang-announce/c/a082jnz-LvI, and the Go vulnerability database entry at https://pkg.go.dev/vuln/GO-2026-5006. As an interim compensating control until binaries are rebuilt, disable agent forwarding to untrusted hosts (ForwardAgent no in ssh_config and remove ssh -A invocations), or stop relying on destination restrictions and instead use short-lived signed certificates or per-host keys so that a stripped-constraint key still has limited blast radius; note this trade-off increases operational overhead but is the only effective workaround since the client silently misbehaves and cannot be reconfigured.

Affected VersionsENISA

golang.org/x/crypto/ssh/agent 0 <0.52.0

Affected Packages

go golang.org/x/crypto fix: 0.52.0

go golang.org/x/crypto/ssh/agent fix: 0.52.0

euvd golang_org_x_crypto_ssh_agent fix: 0.52.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw resides in the SSH agent client implementation under golang.org/x/crypto/ssh/agent, a Go package widely embedded in SSH tooling, CI runners, bastions, and orchestration agents that need to forward keys. The Add code path failed to serialize SSH agent protocol constraint extensions (notably the OpenSSH restrict-destination-v00@openssh.com extension defined to bind a key to specific hop/host pairs) when sending the SSH_AGENTC_ADD_ID_CONSTRAINED message to a remote agent. Although tagged with CWE-502 (Deserialization of Untrusted Data) and the 'Deserialization' tag, the root cause is more accurately a serialization omission: constraint TLV blobs were not written into the request, so the remote agent received an unconstrained key. The companion fix also hardens the in-memory NewKeyring() to reject unknown constraint extensions rather than silently honoring keys as unrestricted.

Know when SSH gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Go) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE CRITICAL

Red Hat 8.7 HIGH

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

May 28, 2026 - 15:22 NVD

9.1 (None) 9.1 (CRITICAL)

Patch available

May 22, 2026 - 04:31 EUVD

CVE Published

May 22, 2026 - 02:31 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Executive ViewAI

Why It Matters

golang.org/x/crypto SSH agent client versions prior to 0.52.0 silently strip destination restrictions from forwarded SSH keys, effectively converting scoped credentials into unrestricted ones on downstream hosts. This fundamentally undermines organizations' ability to limit SSH key usage by destination, exposing systems using Go-based SSH implementations with key forwarding to unauthorized credential reuse within their infrastructure. While no public exploitation has been confirmed, the complete breakdown of key scope controls represents a critical authentication control failure requiring immediate attention.

Business Impact: High

Compensating Controls

Apply vendor patch. Interim mitigation: disable SSH agent forwarding until systems are updated to golang.org/x/crypto 0.52.0 or later.

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA MSRC Vendor CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.