9.1
Critical
CVE-2026-39832 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not…
Description
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/crypto/ssh/agent 0.52 | earliest → < 0.52.0 | 0.52.0 |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Versions not published | |
| Builds for Red Hat OpenShift | Versions not published | |
| External Secrets Operator for Red Hat OpenShift | Versions not published | |
| Multicluster Engine for Kubernetes | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Advanced Cluster Security 4 | Versions not published |
Show the 58 other branches Hide the 58 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260701102925 | earliest → < 8100020260701102925.afee755d | 8100020260701102925.afee755d |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Workspaces Operator | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat OpenStack Platform 16.2 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Red Hat OpenStack Platform 17.1 | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1782891789 | earliest → < 1782891789 | 1782891789 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1783357116 | earliest → < 1783357116 | 1783357116 |
| Red Hat OpenShift Builds 1.7.4 1783058284 | earliest → < 1783058284 | 1783058284 |
| RHEM 1.0 for RHEL 9 | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Versions not published | |
| Red Hat Edge Manager 1.0 1783502445 | earliest → < 1783502445 | 1783502445 |
| Red Hat Trusted Artifact Signer 1.4 1783332061 | earliest → < 1783332061 | 1783332061 |
| Red Hat Openshift Data Foundation 4.22 1782934284 | earliest → < 1782934284 | 1782934284 |
| OpenShift API for Data Protection | Versions not published | |
| Red Hat Edge Manager 1.1 1784127775 | earliest → < 1784127775 | 1784127775 |
| Red Hat Quay 3.9 1784125838 | earliest → < 1784125838 | 1784125838 |
| RHEM 1.1 for RHEL 10 | Versions not published | |
| RHEM 1.1 for RHEL 9 | Versions not published | |
| Red Hat OpenShift Builds 1.8.1 1783612163 | earliest → < 1783612163 | 1783612163 |
| Red Hat Quay 3.10 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.16 1783955846 | earliest → < 1783955846 | 1783955846 |
| Red Hat Trusted Artifact Signer 1.3 1783959819 | earliest → < 1783959819 | 1783959819 |
| Red Hat Advanced Cluster Security 4.9 1783357116 | earliest → < 1783357116 | 1783357116 |
| Red Hat OpenShift Builds 1.7.1 1783058284 | earliest → < 1783058284 | 1783058284 |
| Red Hat Quay 3.1 1783750447 | earliest → < 1783750447 | 1783750447 |
| Red Hat Quay 3.12 1784353904 | earliest → < 1784353904 | 1784353904 |
| Red Hat Quay 3.12 1783751865 | earliest → < 1783751865 | 1783751865 |
| Red Hat Quay 3.15 1784351966 | earliest → < 1784351966 | 1784351966 |
| OpenShift API for Data Protection 1.6 1784058822 | earliest → < 1784058822 | 1784058822 |
| Red Hat OpenShift Builds 1.8.0 1783612163 | earliest → < 1783612163 | 1783612163 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260721142025.63 | earliest → < 8080020260721142025.63b34585 | 8080020260721142025.63b34585 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260721142025.63 | earliest → < 8080020260721142025.63b34585 | 8080020260721142025.63b34585 |
| Red Hat OpenShift Builds 1.7.3 1783058284 | earliest → < 1783058284 | 1783058284 |
| Red Hat OpenShift GitOps 1.19 1785149260 | earliest → < 1785149260 | 1785149260 |
| Red Hat OpenShift GitOps 1.20 1785211346 | earliest → < 1785211346 | 1785211346 |
| Red Hat OpenShift GitOps 1.2 1785211346 | earliest → < 1785211346 | 1785211346 |
| multicluster engine for Kubernetes 2.11 1786912006 | earliest → < 1786912006 | 1786912006 |
| multicluster engine for Kubernetes 2.6 1787259740 | earliest → < 1787259740 | 1787259740 |
| cert-manager Operator for Red Hat OpenShift | Versions not published | |
| ExternalDNS Operator | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Cluster Observability Operator 1.5.2 1787593637 | earliest → < 1787593637 | 1787593637 |
| Cluster Observability Operator 1.5.0 1787593637 | earliest → < 1787593637 | 1787593637 |
| Logging Subsystem for Red Hat OpenShift 6.6 1788439505 | earliest → < 1788439505 | 1788439505 |
References
- go.dev go.dev
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/crypto/ssh/agent
The 5 CVEs of golang.org/x/crypto/ssh/agent →
CVE-2026-46598
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic…
5.3
Medium
CVE-2026-39833
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never…
9.1
Critical
CVE-2025-47914
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the…
5.3
Medium
CVE-2025-47913
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the…
7.5
High