CVE-2026-39831: golang.org/x/crypto/ssh: FIDO/U2F security key physical presence check can be bypassed

June 25, 2026

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a “no-touch-required” extension in Permissions.Extensions from PublicKeyCallback.

References

github.com/advisories/GHSA-89gr-r52h-f8rx
go.dev/cl/781662
go.dev/issue/79566
groups.google.com/g/golang-announce/c/a082jnz-LvI
nvd.nist.gov/vuln/detail/CVE-2026-39831
pkg.go.dev/vuln/GO-2026-5019

Code Behaviors & Features

Detect and mitigate CVE-2026-39831 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →