Serialization Flaw in Remote Agent Constraints Affects OpenSSH Implementation
CVE-2026-39832

9.1CRITICAL

Key Information:

Vendor

Golang.org/x/crypto

Status
Golang.org/x/crypto/ssh/agent
Vendor
CVE Published:
22 May 2026

What is CVE-2026-39832?

A serialization issue in OpenSSH's handling of remote agent constraints leads to the unintentional removal of destination restrictions when keys are forwarded. Specifically, extensions like restrict-destination-v00@openssh.com were not correctly serialized in requests, allowing potentially unrestricted use of keys on remote hosts. The update includes proper serialization of all constraint extensions, and a revision of in-memory key management to reject keys with unsupported extensions, enhancing the overall security of the key management process.

Affected Version(s)

golang.org/x/crypto/ssh/agent 0 < 0.52.0

References

https://go.dev/issue/79435
https://go.dev/cl/778642
https://groups.google.com/g/golang-announce/c/a082jnz-LvI

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NCC Group Cryptography Services, sponsored by Teleport
.