NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Go

CVE-2026-39832: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

criticalCVSS 3.1 9.1GHSA-f5wc-c3c7-36mc

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions.

Published Jun 25, 2026 · Updated Aug 11, 2026

Affected packages

golang.org/x/crypto

Ecosystem
Go
Affected
< 0.52.0
Fixed in
0.52.0
Check
go list -m golang.org/x/crypto

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries