CVE-2026-39832

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all...

CVE-2026-39833

The golang.org/x/crypto/ssh/agent component (used in the Go programming language) contains a vulnerability in the NewKeyring() function. The in-memory keyring silently accepted keys with the ConfirmBeforeUse constraint but failed to enforce it, allowing keys to sign without a confirmation prompt ...