PatchTheCVECVE-2026-39833: The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but
CVE-2026-39833 is a critical-severity flaw (CVSS 9.1) affecting crypto. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 60%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-05-22 |
| Last modified | 2026-08-11 |
Last updated 2026-08-11 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-39833?
crypto: upgrade to 0.52.0. Exact commands for each OS are on this page.
Is CVE-2026-39833 being exploited?
CVE-2026-39833 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-39833 affect?
CVE-2026-39833 affects crypto. Severity is critical (CVSS 9.1). The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was n
How urgent is CVE-2026-39833?
Priority 47/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-39835 MEDIUM 5.3 UPGRADE SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority
- CVE-2026-39830 CRITICAL 9.1 UPGRADE A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the
- CVE-2026-39829 HIGH 7.5 UPGRADE The RSA and DSA public key parsers did not enforce size limits on key parameters
- CVE-2026-42508 CRITICAL 9.1 UPGRADE Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation
- CVE-2026-39832 CRITICAL 9.1 UPGRADE When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were no