Bug 2480675 (CVE-2026-39831) - CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
Summary: CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key...
Keywords:
Status: NEW
Alias: CVE-2026-39831
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2509390 2509391 2509392 2509393 2509394 2509395 2509396 2509397 2509399 2509400 2509401 2509402 2509403 2509405 2509406 2509407 2509408 2509409 2509410 2509411 2509412 2509413 2509414 2509415 2509416 2509417 2509418 2509419 2509420 2509421 2509422 2509423 2509424 2509425 2509426 2509427 2509428 2509429 2509430 2509431 2509432 2509433 2509434 2509435 2509436 2509437 2509438 2509439 2509440 2509441 2509442 2509443 2509444 2509445 2509446 2509447 2509448 2509449 2509450 2509451 2509452 2509453 2509454 2509455 2509457 2509458 2509459 2509460 2509461 2509462 2509463 2509464 2509465 2509466 2509467 2509468 2509469 2509470 2509471 2509472 2509474 2509475 2509476 2509477 2509479 2509480 2509481 2509482 2509483 2509484 2509404 2509456 2509473 2509478
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-22 04:01 UTC by OSIDB Bzimport
Modified: 2026-07-30 14:35 UTC (History)
79 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-22 04:01:35 UTC 
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256, sk-ssh-ed25519) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Note You need to log in before you can comment on or make changes to this bug.