CVE-2026-39832
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
When adding a key to a remote agent, constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host.
Risk Assessment
An attacker can use the forwarded key without destination restrictions, potentially leading to unauthorized access to systems.
Recommendation
Update the SSH client to a version that serializes all constraint extensions and rejects keys with unsupported constraint extensions.
Original NVD description (English source)
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.