VULNERABILITY INTELLIGENCE

CVE-2026-39832

CVSS score9.1 CRITICAL
EPSS probability0.68%
CISA KEVNot currently listed
Published2026-05-22
Last modified2026-09-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Weakness classification

  • nvd@nist.gov: CWE-502
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-281

Primary references