CVE-2026-39833

Description

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

PUBLISHED Reserved 2026-04-07 | Published 2026-05-22 | Updated 2026-05-22 | Assigner Go

Problem types

CWE-358: Improperly Implemented Security Check for Standard

Product status

Credits

NCC Group Cryptography Services, sponsored by Teleport

References

go.dev/issue/79436

go.dev/cl/778640

go.dev/cl/778641

groups.google.com/g/golang-announce/c/a082jnz-LvI

pkg.go.dev/vuln/GO-2026-5005

cve.org (CVE-2026-39833)

nvd.nist.gov (CVE-2026-39833)

Download JSON