NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it, allowing a key to sign data without any confirmation prompt or warning. This flaw effectively removes a hardening layer and can lead to clandestine forgery or credential theft if an attacker gains access to the keyring.

The affected component is the golang.org/x/crypto/ssh/agent package, which provides an in-memory keyring used by SSH agents in Go applications. All releases that include the unpatched NewKeyring() behavior are vulnerable. No specific product version list is available at this time.

The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 9.1, indicating a high‑severity flaw that allows unauthorized signing of data without user confirmation, compromising data integrity. Attackers would need to insert a key endowed with the ConfirmBeforeUse constraint into the agent or gain access to the agent process. Despite the low EPSS probability, the serious potential for clandestine signing makes it a significant risk for affected systems.