CVE-2026-39833
Published: May 22, 2026· Updated: May 28, 2026
Official Description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Risk Analysis
This critical vulnerability in the golang:crypto package involves the in-memory keyring silently accepting and then failing to enforce the 'ConfirmBeforeUse' constraint. Keys would sign without any confirmation, misleading callers about the constraint's effectiveness. With a CVSS score of 9.1, this flaw poses a significant risk to the integrity of key usage.
No public exploit is currently known for this vulnerability. The flaw is remotely exploitable (AV:N) without requiring any authentication (PR:N) or user interaction (UI:N).
Update the golang:crypto package to a version where NewKeyring() returns an error when unsupported constraints are requested. Developers should review their use of keyrings and ensure all desired constraints are properly enforced.
Technical Analysis
CVE-2026-39833 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (5)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-39833 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts