CVE-2026-39831

EUVD-2026-31395
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
golangcrypto
𝑥
< 0.52.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-go.crypto
bookworm
vulnerable
bullseye
postponed
forky
1:0.53.0-1
fixed
sid
1:0.53.0-1
fixed
trixie
vulnerable
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
amazon-ssm-agent
suse enterprise sap 15 SP4
3.3.4624.0-150000.5.37.1
fixed
suse enterprise sap 15 SP5
3.3.4624.0-150000.5.37.1
fixed
suse enterprise sap 15 SP6
3.3.4624.0-150000.5.37.1
fixed
suse enterprise sap 15 SP7
3.3.4624.0-150000.5.37.1
fixed
suse enterprise server 15 SP4
3.3.4624.0-150000.5.37.1
fixed
suse enterprise server 15 SP5
3.3.4624.0-150000.5.37.1
fixed
suse enterprise server 15 SP6
3.3.4624.0-150000.5.37.1
fixed
suse enterprise server 15 SP7
3.3.4624.0-150000.5.37.1
fixed
apptainer
suse enterprise server 15 SP6
1.5.1-150600.4.24.1
fixed
apptainer-sle15_6
suse enterprise server 15 SP6
1.5.1-150600.4.24.1
fixed
buildah
suse enterprise sap 15 SP7
1.35.5-150500.3.62.1
fixed
suse enterprise server 15 SP4
1.35.5-150400.3.68.1
fixed
suse enterprise server 15 SP5
1.35.5-150500.3.62.1
fixed
suse enterprise server 15 SP6
1.35.5-150500.3.62.1
fixed
suse enterprise server 15 SP7
1.35.5-150500.3.62.1
fixed
google-guest-agent
suse enterprise sap 15 SP4
20260529.00-150000.1.70.1
fixed
suse enterprise sap 15 SP5
20260529.00-150000.1.70.1
fixed
suse enterprise sap 15 SP6
20260529.00-150000.1.70.1
fixed
suse enterprise sap 15 SP7
20260529.00-150000.1.70.1
fixed
suse enterprise server 15 SP4
20260529.00-150000.1.70.1
fixed
suse enterprise server 15 SP5
20260529.00-150000.1.70.1
fixed
suse enterprise server 15 SP6
20260529.00-150000.1.70.1
fixed
suse enterprise server 15 SP7
20260529.00-150000.1.70.1
fixed
google-osconfig-agent
suse enterprise sap 15 SP4
20260615.01-150000.1.55.1
fixed
suse enterprise sap 15 SP5
20260615.01-150000.1.55.1
fixed
suse enterprise sap 15 SP6
20260615.01-150000.1.55.1
fixed
suse enterprise sap 15 SP7
20260615.01-150000.1.55.1
fixed
suse enterprise server 15 SP4
20260615.01-150000.1.55.1
fixed
suse enterprise server 15 SP5
20260615.01-150000.1.55.1
fixed
suse enterprise server 15 SP6
20260615.01-150000.1.55.1
fixed
suse enterprise server 15 SP7
20260615.01-150000.1.55.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
amazon-cloudwatch-agent
Amazon Linux 2
0:1.300067.1-1.amzn2
fixed
Amazon Linux 2023
0:1.300067.1-1.amzn2023
fixed
containerd
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.1
fixed
containerd-debuginfo
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.1
fixed
containerd-debugsource
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.1
fixed
containerd-stress
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.1
fixed
containerd-stress-debuginfo
Amazon Linux 2023
0:2.2.4-1.amzn2023.0.1
fixed
docker
Amazon Linux 2023
0:25.0.16-1.amzn2023.0.1
fixed
docker-debuginfo
Amazon Linux 2023
0:25.0.16-1.amzn2023.0.1
fixed
docker-debugsource
Amazon Linux 2023
0:25.0.16-1.amzn2023.0.1
fixed
nerdctl
Amazon Linux 2
0:2.2.2-1.amzn2.0.3
fixed
Amazon Linux 2023
0:2.2.2-1.amzn2023.0.3
fixed
nerdctl-debuginfo
Amazon Linux 2
0:2.2.2-1.amzn2.0.3
fixed
rclone
Amazon Linux 2
0:1.55.1-1.amzn2.0.7
fixed
Amazon Linux 2023
0:1.74.2-80.amzn2023
fixed
rclone-debuginfo
Amazon Linux 2
0:1.55.1-1.amzn2.0.7
fixed
Amazon Linux 2023
0:1.74.2-80.amzn2023
fixed
rclone-debugsource
Amazon Linux 2023
0:1.74.2-80.amzn2023
fixed
runfinch-finch
Amazon Linux 2023
0:1.17.1-1.amzn2023.0.2
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://go.dev/cl/781662
https://go.dev/issue/79566
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
https://pkg.go.dev/vuln/GO-2026-5019