Is CVE-2026-39832 actively exploited?

No active exploitation of CVE-2026-39832 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-39832 be exploited remotely?

Yes. CVE-2026-39832 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-39832?

CVE-2026-39832 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-39832

CRITICAL

CVE-2026-39832

Published: May 22, 2026· Updated: May 28, 2026

9.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.8th

Official Description

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

NVD Source

Risk Analysis

This critical vulnerability in golang:crypto allows an attacker to bypass destination restrictions on forwarded SSH keys. The flaw, rated 9.1 CVSS, means that keys intended for limited use can be exploited without any restrictions on remote hosts. This could lead to unauthorized access and compromise of systems.

No public exploit is currently known for this remotely exploitable vulnerability. The low complexity of exploitation suggests it could be easily weaponized once discovered.

Recommended Action

Users should update their golang:crypto library to a version that serializes all constraint extensions and rejects unsupported ones. Review SSH key usage policies and ensure all keys have appropriate restrictions enforced at the source and destination.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-39832 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.