CVE-2026-39832

Description

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• v3.1•HIGH•Score: 8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.60%• Percentile: 47%

Techniques & Countermeasures

• CWE-502•Deserialization of Untrusted Data

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

• CWE-281•Improper Preservation of Permissions

  The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Systems

• chainguard•aactl

  < 0.4.12-r53

• chainguard•act

  < 0.2.88-r6

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•age

  < 0

• chainguard•age-fips

  < 0 | < 1.3.1-r11

• chainguard•agentbeat

  < 0

• chainguard•agentbeat-fips

  < 0

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent

  < 0

• chainguard•amazon-cloudwatch-agent-fips

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-ssm-agent

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 3.3.4515.0-r3

• chainguard•amazon-ssm-agent-fips

  < 3.3.4515.0-r3

• chainguard•apache-exporter

  < 0

• chainguard•apko

  < 1.2.14-r2

• chainguard•apko-fips

  < 1.2.14-r2

• chainguard•apm-server-8.19

  < 0

• chainguard•apm-server-9.1

  all

• chainguard•apm-server-9.3

  < 0

• chainguard•apm-server-9.4

  < 0

• chainguard•apply-cve-bump

  < 0.2.280-r0

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  < 3.1.16-r3

• chainguard•argo-cd-3.1-compat

  < 3.1.16-r3

• chainguard•argo-cd-3.3-compat

  < 3.3.14-r9

• chainguard•argo-cd-3.4

  < 3.4.2-r4

• chainguard•argo-cd-3.4-compat

  < 3.4.2-r4

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.2

  < 3.2.12-r5

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.12-r5

• chainguard•argo-cd-fips-3.4

  < 3.4.2-r4

• chainguard•argo-cd-fips-3.4-compat

  < 3.4.2-r4

• chainguard•argo-events

  < 1.9.10-r24

• chainguard•argo-events-fips

  < 1.9.10-r17

• chainguard•argo-rollouts

  < 0

• chainguard•argo-workflow-controller-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-controller-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflow-executor-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-executor-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflows-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-fips-3.6

  < 3.6.19-r9

• chainguard•argocd-image-updater

  < 1.2.1-r2

Showing first 50 affected entries in server-rendered view.

References (51)

• https://go.dev/issue/79435
• https://go.dev/cl/778642
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://pkg.go.dev/vuln/GO-2026-5006
• https://nvd.nist.gov/vuln/detail/CVE-2026-39832
• https://cs.opensource.google/go/x/crypto
• https://access.redhat.com/security/cve/CVE-2026-39832
• https://bugzilla.redhat.com/show_bug.cgi?id=2480685
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json
• https://access.redhat.com/errata/RHSA-2026:36199
• https://access.redhat.com/errata/RHSA-2026:35833
• https://access.redhat.com/errata/RHSA-2026:36625
• https://access.redhat.com/errata/RHSA-2026:36319
• https://access.redhat.com/errata/RHSA-2026:36648
• https://access.redhat.com/errata/RHSA-2026:36796
• https://access.redhat.com/errata/RHSA-2026:37072
• https://access.redhat.com/errata/RHSA-2026:37123
• https://access.redhat.com/errata/RHSA-2026:36651
• https://access.redhat.com/errata/RHSA-2026:36797
• https://access.redhat.com/errata/RHSA-2026:37271
• https://access.redhat.com/errata/RHSA-2026:37410
• https://access.redhat.com/errata/RHSA-2026:37387
• https://access.redhat.com/errata/RHSA-2026:41019
• https://access.redhat.com/errata/RHSA-2026:40945
• https://access.redhat.com/errata/RHSA-2026:40118
• https://access.redhat.com/errata/RHSA-2026:41036
• https://access.redhat.com/errata/RHSA-2026:41031
• https://access.redhat.com/errata/RHSA-2026:41066
• https://access.redhat.com/errata/RHSA-2026:40262
• https://access.redhat.com/errata/RHSA-2026:40972
• https://access.redhat.com/errata/RHSA-2026:42146
• https://access.redhat.com/errata/RHSA-2026:42796
• https://go.dev/cl/778640
• https://go.dev/cl/778641
• https://access.redhat.com/errata/RHSA-2026:49944
• https://access.redhat.com/errata/RHSA-2026:43692
• https://access.redhat.com/errata/RHSA-2026:52857
• https://access.redhat.com/errata/RHSA-2026:52910
• https://access.redhat.com/errata/RHSA-2026:43052
• https://security-tracker.debian.org/tracker/CVE-2026-39832
• https://access.redhat.com/errata/RHSA-2026:57194
• https://ubuntu.com/security/CVE-2026-39832
• https://www.cve.org/CVERecord?id=CVE-2026-39832
• https://github.com/golang/crypto/commit/e3d1254f1e7e60baa086142c46174bf6d8d0fe50
• https://ubuntu.com/security/notices/USN-8447-1
• https://access.redhat.com/errata/RHSA-2026:59579
• https://access.redhat.com/errata/RHSA-2026:61314
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39832.json
• https://access.redhat.com/errata/RHSA-2026:66521
• https://access.redhat.com/errata/RHSA-2026:67450