UNKNOWN Go
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
GO-2026-5005 · CVE-2026-39833 · GHSA-jppx-rxg9-jmrx
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes