CVE-2026-39831 json
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
published 2026-05-22 5 mo ago modified 2026-09-17 53 d ago also EUVD-2026-31395 , GHSA-89gr-r52h-f8rx , GO-2026-5019
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Patch / fix
- go golang.org/x/crypto 0.52.0
- golang.org/x/crypto golang.org/x/crypto/ssh 0.52.0
- golang-go.crypto Debian 14 1:0.52.0-1
debian advisories DEBIAN-CVE-2026-39831
- google-guest-agent Ubuntu 22.04 LTS 20250116.00-0ubuntu1~22.04.3
- google-guest-agent Ubuntu 24.04 LTS 20250116.00-0ubuntu1~24.04.4
- google-guest-agent Ubuntu 25.10 20250506.01-0ubuntu1.2
- google-guest-agent Ubuntu 26.04 LTS 20250506.01-0ubuntu2.1
- golang-go.crypto Ubuntu Pro 20.04 LTS 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm2
- golang-go.crypto Ubuntu Pro 22.04 LTS 1:0.0~git20211202.5770296-1ubuntu0.1~esm2
- golang-go.crypto Ubuntu Pro 24.04 LTS 1:0.19.0-1ubuntu0.1~esm2
- golang-go.crypto Ubuntu Pro 26.04 LTS 1:0.47.0-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2026-39831
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- flightctl edge manager 1.1 1.1.4-1.el10em
- flightctl edge manager 1.1 1.1.4-1.el9em
- flightctl-cli edge manager 1.1 1.1.4-1.el10em
- flightctl-cli edge manager 1.1 1.1.4-1.el9em
- flightctl-agent edge manager 1.1 1.1.4-1.el10em
- flightctl-agent edge manager 1.1 1.1.4-1.el9em
- podman RHEL 9.6 EUS 5:5.4.0-22.el9_6.5
- podman-tests RHEL 9.6 EUS 5:5.4.0-22.el9_6.5
red hat advisories RHSA-2026:68334RHSA-2026:67450
- distribution SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 3.1.1-150400.9.41.1
- containerized-data-importer SLE Module for Containers 15 SP7 1.64.0-150700.9.14.1
- kubevirt SLE Module for Containers 15 SP7 1.7.4-150700.3.30.1
- terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
- terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
- terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1
- terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.18.1
- terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.17.1
suse advisories SUSE-SU-2026:4212-1SUSE-SU-2026:4209-1SUSE-SU-2026:3203-1SUSE-SU-2026:3056-1SUSE-SU-2026:22613-1SUSE-SU-2026:2827-1
- cloudflared openSUSE Leap 16.0 2026.9.1-bp160.1.1
- cloudflared openSUSE Tumbleweed 2026.9.1-1.1
- kit openSUSE Tumbleweed 0.107.0-1.1
- containerized-data-importer1.65 openSUSE Leap 16.0 1.65.0-160000.3.1
- glab openSUSE Leap 16.0 1.114.0-bp160.1.1
- kubevirt1.8 openSUSE Leap 16.0 1.8.4-160000.1.1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- rclone openSUSE Leap 16.0 1.74.4-bp160.1.1
opensuse advisories openSUSE-SU-2026:21924-1openSUSE-SU-2026:11813-1openSUSE-SU-2026:11806-1openSUSE-SU-2026:21824-1openSUSE-SU-2026:21662-1openSUSE-SU-2026:21590-1
- go.dev/cl/781662 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-39831 updated cvss 8.1
golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, openshift-builds/openshift-builds-image-bundler-rhel9, openshift-builds/openshift-builds-image-processing-rhel9affected: no fix available
-
Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9affected: no fix planned “Will not fix”
-
Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/hypershift-rhel9-operator, multicluster-engine/cluster-api-provider-azure-rhel9, multicluster-engine/cluster-image-set-controller-rhel9, multicluster-engine/cluster-api-provider-kubevirt-rhel9 Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-results-api-rhel9, openshift-pipelines/pipelines-results-watcher-rhel9, openshift-pipelines/pipelines-chains-controller-rhel9, openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9, openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/multicluster-operators-subscription-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operatoraffected: no fix available
-
Red Hat Ceph Storage 9 rhceph/alloy-rhel10affected: no fix available “Fix deferred”
-
Red Hat Enterprise Linux 8 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +4 more Red Hat Enterprise Linux 9 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +5 more Red Hat Enterprise Linux 10 podman, buildah, gvisor-tap-vsock Red Hat OpenShift AI (RHOAI) rhoai/odh-ogx-module-operator-rhel9affected: no fix available
-
Red Hat OpenShift Container Platform 4 podman, microshift, podman-tests, podman-docker, podman-remote, microshift-olm, +40 moreaffected: no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 5 openshift5/ose-azure-file-csi-driver-rhel9, openshift5/ose-cluster-capi-rhel9-operator, openshift5/ose-machine-api-provider-azure-rhel9 Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-rhel9-operator, devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator Red Hat OpenShift GitOps openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirtaffected: no fix available
+3 more productsfewer
Red Hat Quay 3 quay/quay-builder-rhel8, quay/quay-builder-rhel9 Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/model-validation-agent-rhel9 Red Hat Zero Trust Workload Identity Manager zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 -
Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9affected: no fix planned “Will not fix”
show 15 moreshow fewer
-
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080fixed: vendor fix RHSA-2026:82322
-
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/cluster-observability-rhel9-operator 1787593637fixed: vendor fix RHSA-2026:61314
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/cluster-logging-rhel9-operator 1789659166fixed: vendor fix RHSA-2026:70870
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/cluster-logging-rhel9-operator 1788439505fixed: vendor fix RHSA-2026:66521
-
Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hypershift-addon-rhel9-operator 1787264068fixed: vendor fix RHSA-2026:59579
-
Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hypershift-addon-rhel9-operator 1787259113fixed: vendor fix RHSA-2026:59558
-
Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hypershift-addon-rhel9-operator 1786475964fixed: vendor fix RHSA-2026:59559
-
Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hypershift-addon-rhel9-operator 1786548381fixed: vendor fix RHSA-2026:54432
-
Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/azure-service-operator-rhel9 1790133543, multicluster-engine/hypershift-addon-rhel9-operator 1786912006fixed: vendor fix RHSA-2026:72848
-
Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1785180878, oadp/oadp-mustgather-rhel9 1785177359, oadp/oadp-velero-restic-restore-helper-rhel9 1785177438fixed: vendor fix RHSA-2026:51033
-
Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1786944540, oadp/oadp-mustgather-rhel9 1786946294, oadp/oadp-velero-restic-restore-helper-rhel9 1786946190fixed: vendor fix RHSA-2026:59467
-
Red Hat OpenShift API for Data Protection 1.5 oadp/oadp-velero-rhel9 1788860461, oadp/oadp-mustgather-rhel9 1788859896fixed: vendor fix RHSA-2026:66022
-
Red Hat OpenShift API for Data Protection 1.6 oadp/oadp-velero-rhel9 1784058822fixed: vendor fix RHSA-2026:43692
-
Red Hat OpenShift Security Profiles Operator 1 compliance/openshift-security-profiles-rhel8-operator 1790623030, compliance/openshift-security-profiles-operator-bundle 1790626888fixed: vendor fix RHSA-2026:76752
-
Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/volsync-rhel9 1786456658fixed: vendor fix RHSA-2026:54400
30 more fixed, 58 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | golang.org/x/crypto | <0.52.0 |
0.52.0 |
Affected products
- golang.org/x/crypto golang.org/x/crypto/ssh
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
go.dev
/cl/781662
web, issue-tracking, patch
-
pkg.go.dev
/vuln/GO-2026-5019
web, vendor-advisory
-
go.dev
/issue/79566
web, issue-tracking, report
-
groups.google.com
/g/golang-announce/c/a082jnz-LvI
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2026-39831
advisory
-
cs.opensource.google
/go/x/crypto
package
Sources
- CVE List CVE-2026-39831
- GitHub Advisory GHSA-89gr-r52h-f8rx
- NVD CVE-2026-39831
- OSV GO-2026-5019
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.