ZeroDay Findings
Sign inSign up

Findings

CVE-2026-39832

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request.

Published May 22, 2026 · updated Sep 15, 2026 · golang crypto

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 22, 2026 · NIST NVD

    Detected

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys wit

  2. Sep 15, 2026 · NIST NVD

    Updated

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys wit

Affected

  • cpe golang/cryptoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-39832

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-39832

    When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now

    nvd.nist.gov

References