The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 22, 2026 · NIST NVD

   Detected

   The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

2. Aug 11, 2026 · NIST NVD

   Updated

   The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Affected

• cpe golang/cryptoversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-39833

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-39833

  The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns a

  nvd.nist.gov

References

• Reference · go.dev
• Issue Tracking · go.dev
• Mailing List · groups.google.com
• Vendor Advisory · pkg.go.dev