CVE-2026-39833
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The in-memory NewKeyring() function silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without confirmation, with no indication to the caller. NewKeyring() now returns an error when unsupported constraints are requested.
Risk Assessment
The organization may unknowingly use keys that should require confirmation before use, increasing the risk of unauthorized cryptographic operations.
Recommendation
Update the library to a version where NewKeyring() returns an error for unsupported constraints. Verify that no code relies on silent ignoring of constraints.
Original NVD description (English source)
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.