CVE-2026-39833
CriticalSummary
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect.
Risk Assessment
The lack of enforcement for confirmation before key usage may lead to unauthorized signing of data, posing a risk to the integrity and confidentiality of information within the organization.
Recommendation
It is recommended to update to the latest version to avoid issues related to unsupported constraints and ensure proper confirmation before key usage.
Original NVD description (English source)
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.