Security readout for executives and security teams
Plain-English summary
Applications using Go's in-memory SSH agent keyring could promise human confirmation before a key signs, yet silently sign without confirmation. This can undermine approval controls protecting sensitive SSH credentials. Exposure is limited to software using NewKeyring() with ConfirmBeforeUse and relying on that constraint for security.
Executive priority
Treat as urgent where confirmation gates protect privileged SSH keys or production access. Request rapid inventory and remediation, but scope priority to confirmed NewKeyring plus ConfirmBeforeUse usage. The absence of reported exploitation lowers immediate incident certainty, not the potential impact of bypassed signing approval.
Technical view
In golang.org/x/crypto/ssh/agent, NewKeyring() accepted ConfirmBeforeUse despite not implementing it. Constrained keys could therefore sign without prompting or warning the caller. The corrected behavior rejects unsupported constraints. The supplied CVSS 3.1 score is 9.1, but the bundle does not identify precise affected or fixed module versions.
Likely exposure
Prioritize Go applications, automation, developer tooling, and services that import golang.org/x/crypto/ssh/agent, instantiate NewKeyring(), and add keys with ConfirmBeforeUse. Importing the package alone does not establish vulnerability. The source bundle's version data is insufficient for reliable version-only detection.
Exploitation context
The bundle does not report active exploitation, and this CVE is not listed as KEV. Abuse would require access to a workflow capable of requesting signatures from an affected in-memory agent. The flaw removes an expected confirmation barrier; it does not establish that every network-accessible application is directly exploitable.
Researcher notes
CWE-358 fits improper handling of an unsupported security constraint. The decisive condition is behavioral: silent acceptance followed by signing without confirmation. Version attribution remains incomplete because the bundle lists version "0" and no fixed release. Confirm exact affected ranges through the Go advisory and change references before producing scanner rules.
Mitigation direction
- Identify vendor guidance specifying affected and corrected golang.org/x/crypto versions.
- Update to a release containing the documented NewKeyring constraint rejection.
- Do not rely on ConfirmBeforeUse with affected in-memory keyrings.
- Use an agent implementation that demonstrably enforces required confirmation controls.
- Restrict access to agent-signing interfaces while remediation is pending.
Validation and detection
- Inventory applications importing golang.org/x/crypto/ssh/agent and record resolved module versions.
- Review code for NewKeyring() combined with ConfirmBeforeUse.
- Test that adding a key with unsupported constraints returns an error.
- Confirm security-sensitive signing cannot proceed without the intended approval control.
- Review available telemetry for unexpected agent signing during the exposure period.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-358: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-39833 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://go.dev/issue/79436CVE reference, Go
- https://go.dev/cl/778642CVE reference, Go
- https://groups.google.com/g/golang-announce/c/a082jnz-LvICVE reference, Go
- https://pkg.go.dev/vuln/GO-2026-5005CVE reference, Go
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improperly Implemented Security Check for Standard
Improperly Implemented Security Check for Standard represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.