« Volver al listado

CVE-2026-39833

Estado: ModificadaCrítica (9.1)—

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de aplicación expuesta (AV:N, PR:N, UI:N) en golang crypto: keyring ignora restricciones de confirmación, permitiendo firma no autorizada de claves con acceso remoto sin autenticación (C:H, I:H). Impacto primario: escalación de privilegios mediante falsificación de credenciales/firmas

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

Golang — Crypto

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-39833",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39833",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-22T18:57:41.103317Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "golang.org/x/crypto",
          "product": "golang.org/x/crypto/ssh/agent",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.52.0",
              "versionType": "semver"
            }
          ],
          "packageName": "golang.org/x/crypto/ssh/agent",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "keyring.Add"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-22T04:16:22.773",
  "references": [
    {
      "url": "https://go.dev/cl/778642",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/79436",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
      "tags": [
        "Mailing List"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2026-5005",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested."
    },
    {
      "lang": "es",
      "value": "El llavero en memoria devuelto por NewKeyring() aceptó silenciosamente claves con la restricción ConfirmBeforeUse pero nunca la aplicó. La clave firmaría sin ninguna solicitud de confirmación, sin ninguna indicación al llamador de que la restricción no estaba en vigor. NewKeyring() ahora devuelve un error cuando se solicitan restricciones no compatibles."
    }
  ],
  "lastModified": "2026-08-11T22:17:25.250",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D540395B-31B8-4B07-8F79-F5C631BBD5C8",
              "versionEndExcluding": "0.52.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}