CVE-2026-39833

Katalog CVE

CVSS 9.1 · Critical EPSS 0,49%

Kerentanan Missing Authorization pada golang crypto. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Rincian

Terbit di NVD

22 Mei 2026

Terakhir diubah

11 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2026-5005 advisory vendor
• https://go.dev/cl/778642
• https://go.dev/issue/79436 issue tracking
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI mailing list