Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-39833: golang.org/x/crypto keyring can sign without confirmation
CVE-2026-39833 · published 4 months ago
Summary
The key storage component in golang.org/x/crypto allowed keys marked as needing user approval to be used automatically, so operations could happen without a confirmation prompt. This affects software that includes this library, such as Canonical’s Go runtime, LXD, snapd, Google Guest Agent, and related components. Upgrade to the latest patched version of the library, which now returns an error when unsupported confirmation constraints are requested.
What to do
- Update x golang.org/x/crypto to version 0.52.0.
- Update golang.org x to version 0.52.0.
- Update x rootio-golang.org/x/crypto to version v0.45.0-root.io.1.
- Update x golang.org/x/crypto to version v0.45.0-aikido.1.
- Update x rootio-golang.org/x/crypto to version v0.35.0-root.io.3.
- Update x golang.org/x/crypto to version v0.35.0-aikido.3.
- Update x rootio-golang.org/x/crypto to version v0.45.0-root.io.2.
- Update x golang.org/x/crypto to version v0.45.0-aikido.2.
- Update x rootio-golang.org/x/crypto to version v0.46.0-root.io.2.
- Update x golang.org/x/crypto to version v0.46.0-aikido.2.
- Update x golang.org/x/crypto to version v0.32.0-aikido.3.
- Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.3.
- Update x golang.org/x/crypto to version v0.32.0-aikido.5.
- Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.5.
- Update x golang.org/x/crypto to version v0.32.0-aikido.4.
- Update x rootio-golang.org/x/crypto to version v0.32.0-root.io.4.
- Update x golang.org/x/crypto to version v0.31.0-aikido.9.
- Update x rootio-golang.org/x/crypto to version v0.31.0-root.io.9.
- Update debian golang-go.crypto to version 1:0.52.0-1.
- Update x golang.org/x/crypto to version v0.46.0-aikido.3.
- Update x rootio-golang.org/x/crypto to version v0.46.0-root.io.3.
- Update canonical golang-go.crypto to version 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2.
- Update canonical lxd to version 2.0.11-0ubuntu1~16.04.4+esm3.
- Update canonical lxd to version 3.0.3-0ubuntu1~18.04.2+esm3.
- Update canonical golang-go.crypto to version 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2.
- Update canonical golang-go.crypto to version 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2.
- Update canonical golang-go.crypto to version 1:0.0~git20211202.5770296-1ubuntu0.1~esm2.
- Update canonical golang-go.crypto to version 1:0.19.0-1ubuntu0.1~esm2.
- Update canonical golang-go.crypto to version 1:0.47.0-1ubuntu0.1~esm1.
- Update golang crypto to version 0.52.0 or later.
- Update golang.org/x/crypto golang.org/x/crypto/ssh/agent to version 0.52.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2 Fix: upgrade to 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm2
|
| Ubuntu:Pro:16.04:LTS | canonical | lxd |
< 2.0.11-0ubuntu1~16.04.4+esm3 Fix: upgrade to 2.0.11-0ubuntu1~16.04.4+esm3
|
| Ubuntu:Pro:16.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | lxd |
< 3.0.3-0ubuntu1~18.04.2+esm3 Fix: upgrade to 3.0.3-0ubuntu1~18.04.2+esm3
|
| Ubuntu:Pro:18.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2 Fix: upgrade to 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm2
|
| Ubuntu:Pro:18.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2 Fix: upgrade to 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2
|
| Ubuntu:22.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:22.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | golang-go.crypto |
< 1:0.0~git20211202.5770296-1ubuntu0.1~esm2 Fix: upgrade to 1:0.0~git20211202.5770296-1ubuntu0.1~esm2
|
| Ubuntu:24.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:24.04:LTS | canonical | snapd | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | golang-go.crypto |
< 1:0.19.0-1ubuntu0.1~esm2 Fix: upgrade to 1:0.19.0-1ubuntu0.1~esm2
|
| Ubuntu:25.10 | canonical | golang-go.crypto | All versions |
| Ubuntu:25.10 | canonical | google-guest-agent | All versions |
| Ubuntu:25.10 | canonical | snapd | All versions |
| Ubuntu:26.04:LTS | canonical | golang-go.crypto | All versions |
| Ubuntu:26.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:26.04:LTS | canonical | snapd | All versions |
| Go | x | golang.org/x/crypto |
< 0.52.0 Fix: upgrade to 0.52.0
|
| Debian:11 | debian | golang-go.crypto | All versions |
| Debian:12 | debian | golang-go.crypto | All versions |
| Debian:13 | debian | golang-go.crypto | All versions |
| Debian:14 | debian | golang-go.crypto |
< 1:0.52.0-1 Fix: upgrade to 1:0.52.0-1
|
| – | golang | crypto |
< 0.52.0 cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* |
| go | golang.org | x |
< 0.52.0 Fix: upgrade to 0.52.0
|
| Root:Go | x | rootio-golang.org/x/crypto |
< v0.45.0-root.io.1 < v0.35.0-root.io.3 < v0.45.0-root.io.2 < v0.46.0-root.io.2 < v0.32.0-root.io.3 < v0.32.0-root.io.5 < v0.32.0-root.io.4 < v0.31.0-root.io.9 < v0.46.0-root.io.3 Fix: upgrade to v0.45.0-root.io.1
|
| Root:Go | x | golang.org/x/crypto |
< v0.45.0-aikido.1 < v0.35.0-aikido.3 < v0.45.0-aikido.2 < v0.46.0-aikido.2 < v0.32.0-aikido.3 < v0.32.0-aikido.5 < v0.32.0-aikido.4 < v0.31.0-aikido.9 < v0.46.0-aikido.3 Fix: upgrade to v0.45.0-aikido.1
|
| – | golang.org/x/crypto | golang.org/x/crypto/ssh/agent | < 0.52.0 |
| Ubuntu:Pro:26.04:LTS | canonical | golang-go.crypto |
< 1:0.47.0-1ubuntu0.1~esm1 Fix: upgrade to 1:0.47.0-1ubuntu0.1~esm1
|
Original advisory text
CVE-2026-39833 in golang.org/x/crypto - Patched by Root
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
References
- https://ubuntu.com/security/notices/USN-8447-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8447-2 Vendor Advisory
- https://go.dev/cl/778640 Third Party Advisory
- https://go.dev/cl/778641 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-39833 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-39833 Third Party Advisory
- https://github.com/golang/crypto/commit/0fb843a472225645e917c84f1f9744757f0bab14 Third Party Advisory
- https://github.com/advisories/GHSA-jppx-rxg9-jmrx
- https://pkg.go.dev URL
- https://go.dev/cl/778642 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39833... Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-39833 Third Party Advisory
- https://go.dev/issue/79436 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/a082jnz-LvI Third Party Advisory
- https://pkg.go.dev/vuln/GO-2026-5005 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39833 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-862Missing Authorization
CWE-358Improperly Implemented Security Check for Standard
Timeline
Published22 May 2026
Updated11 Oct 2026
First seen22 May 2026
Sources
UBUNTU-CVE-2026-39833 · OSV
DEBIAN-CVE-2026-39833 · OSV
GO-2026-5005 · OSV
CVE-2026-39833 · NVD
GHSA-jppx-rxg9-jmrx · GHSA
CVE-2026-39833 · OSV
CVE-2026-39833 · MITRE
Track software like this
Free during beta