SSH Agent Constraint-Serialization Bug (v<0.52.0)
CVE-2026-39832 Published on May 22, 2026

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

NVD

Vulnerability Analysis

CVE-2026-39832 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

Improper Preservation of Permissions

The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Products Associated with CVE-2026-39832

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-39832 are published in these products:

Canonical Ubuntu Linux

Red Hat Assisted Installer

Red Hat Openshift Builds

Red Hat External Secrets Operator

Red Hat Multicluster Engine

Red Hat Openshift Pipelines

Red Hat Serverless

Red Hat Acm

Red Hat Advanced Cluster Security

Red Hat Ceph Storage

Red Hat Edge Manager

Red Hat Enterprise Linux (RHEL)

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Devworkspace

Red Hat Openshift Gitops

Red Hat Container Native Virtualization

Red Hat Openstack

Red Hat Quay

Red Hat Trusted Artifact Signer

Red Hat Openshift Api Data Protection

Red Hat Rhel Tus

Red Hat Rhel E4s

Affected Versions

golang.org/x/crypto/ssh/agent:

Before 0.52.0 is affected.

Red Hat Enterprise Linux 10:

Version 2:1.43.1-3.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 7:5.8.2-4.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020260701102925.afee755d and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 8080020260721142025.63b34585 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 8080020260721142025.63b34585 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 6:5.8.2-4.el9_8 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 2:1.43.1-3.el9_8 and below * is unaffected.

Red Hat RHEM 1.0 for RHEL 9:

Version 0:1.0.3-1.el9em and below * is unaffected.

Red Hat RHEM 1.1 for RHEL 10:

Version 0:1.1.3-1.el10em and below * is unaffected.

Red Hat RHEM 1.1 for RHEL 9:

Version 0:1.1.3-1.el9em and below * is unaffected.

Red Hat OpenShift API for Data Protection 1.6:

Version 1784058822 and below * is unaffected.

Red Hat Advanced Cluster Security 4.9:

Version 1782891812 and below * is unaffected.

Red Hat Advanced Cluster Security 4.9:

Version 1782891812 and below * is unaffected.

Red Hat Advanced Cluster Security 4.9:

Version 1783357116 and below * is unaffected.

Red Hat Advanced Cluster Security for Kubernetes 4.10:

Version 1782891789 and below * is unaffected.

Red Hat Advanced Cluster Security for Kubernetes 4.10:

Version 1782891789 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502022 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502465 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502025 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502494 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502401 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502403 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502022 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502023 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502029 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502445 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194638 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194353 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784196588 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784195620 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194309 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194144 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194188 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194653 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194144 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194980 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194347 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194971 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784128388 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784128860 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126780 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127787 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126762 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127762 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126832 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126774 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127791 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127135 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126733 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127775 and below * is unaffected.

Red Hat OpenShift Builds 1.7.3:

Version 1783057515 and below * is unaffected.

Red Hat OpenShift Builds 1.7.3:

Version 1783057529 and below * is unaffected.

Red Hat OpenShift Builds 1.7.3:

Version 1783057884 and below * is unaffected.

Red Hat OpenShift Builds 1.7.3:

Version 1783058067 and below * is unaffected.

Red Hat OpenShift Builds 1.7.3:

Version 1783057868 and below * is unaffected.

Red Hat OpenShift Builds 1.7.3:

Version 1783058284 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783612432 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783611973 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783612714 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783611805 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1784121108 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783612119 and below * is unaffected.

Red Hat OpenShift Builds 1.8.1:

Version 1783612163 and below * is unaffected.