Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-22 | 1 | Active Exploitation1 |
| 2026-08-06 | 1 | General1 |
Patching windows matter. CVE-2026-39833 is a good reminder why. http://golang.org/x/crypto/ssh/agent doesn't enforce invoking key constraints The best defense is the one you set up before you needed it.
Post summary
CVE‑2026‑39833 is highlighted as a vulnerability in golang’s SSH agent that fails to enforce key constraints, with a reminder that timely patching is essential.
Attention, elevated activities detected targeting x-crypto (CVE-2026-39833) https://vuldb.com/vuln/365128/cti
Post summary
The post reports elevated activity against CVE‑2026‑39833, indicating that it is likely being exploited in the wild, though no PoC, exploit code, or mitigation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | golang | crypto | - | go | - |