CVE-2026-39833

The NewKeyring() function creates an in-memory keyring that should enforce the ConfirmBeforeUse restriction — requiring explicit confirmation before using a key for signing. In the vulnerable version, this restriction was silently ignored: the keyring would accept keys with this restriction without reporting an error, and then perform signing operations without any prompt. The calling code had no way to detect this lack of enforcement because no error or warning was returned. After the patch is applied, NewKeyring() returns an error when unsupported restrictions are passed.

An attacker or malicious code that gains access to the keyring can cause it to sign data or perform operations without the required user confirmation, bypassing the access control provided by the ConfirmBeforeUse restriction. This can lead to unauthorized use of cryptographic keys and violation of integrity and confidentiality of protected resources.

Apply patches available from the vendor according to references (including https://go.dev/cl/778640 and https://go.dev/cl/778641). It is recommended to update the golang.org/x/crypto library to a version containing the fix described in GO-2026-5005.

Golang Crypto library — versions indicated in vendor references (golang.org/x/crypto); the vulnerability affects applications using NewKeyring() with the ConfirmBeforeUse restriction.