Skip to main content

Missing Authorization in github.com/golang/crypto

CVE-2026-39833

  • github.com/golang/crypto
  • golang.org/x/crypto
Medium
5.3/10

Summary

The in-memory keyring returned by "NewKeyring()" silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. "NewKeyring()" now returns an error when unsupported constraints are requested. This affects versions prior to 0.52.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published