NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it, allowing a key to sign data without any confirmation prompt or warning. As a result, keys trusted to require user confirmation can be used without user interaction, enabling unauthorized signing of data or code. This flaw effectively removes a hardening layer and can lead to clandestine forgery or credential theft if an attacker gains access to the keyring.

The affected component is the golang.org/x/crypto/ssh/agent package, which provides an in-memory keyring used by SSH agents in Go applications. All releases that include the unpatched NewKeyring() behavior are vulnerable. No specific product version list is available at this time.

EPSS not available and the vulnerability is not listed in the CISA KEV catalog. The published CVSS score is missing, but the vulnerability permits unauthorized use of cryptographic keys with a high impact on data integrity and confidentiality. Attackers would need to have either written a key with the constraint into the agent or already have access to the agent process. Given the lack of exploit data, the exploitation likelihood is unclear, yet the serious potential for unauthorized signing makes it a high‑severity risk for affected systems.