ssh/agent: ConfirmBeforeUse Constraint Silently Not Enforced

This CVE does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh/agent package is a transitive dependency but its code paths are never invoked during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.

Component

golang.org/x/crypto (SSH)

Disclosed

May 26, 2026

Description

The ConfirmBeforeUse key constraint in Go’s golang.org/x/crypto/ssh/agent in-memory keyring is silently not enforced. Keys marked for confirmation before use can be used without confirmation, undermining the intended access control.

References

View CVE-2026-39833 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates