Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability allows an attacker to bypass SSH agent key constraints by exploiting a flaw in the serialization process. When a key with constraints is forwarded to a remote agent, the vulnerable remote.add function in ssh/agent/client.go fails to include these constraints in the request. As a result, the key can be used on the remote host without any of the intended restrictions.
The patch addresses this issue by modifying the remote.add function to correctly serialize all constraint extensions using a new serializeConstraints helper. This ensures that all security constraints are preserved when forwarding keys.
Additionally, the NewKeyring function in ssh/agent/keyring.go was made more secure by rejecting keys with unsupported constraints, preventing them from being silently ignored. This change improves the overall security posture of the SSH agent by ensuring that all constraints are explicitly handled.
By analyzing the patch, we can identify remote.add as the primary vulnerable function, as it is directly responsible for the incorrect handling of key constraints. The change to NewKeyring is a related security improvement that hardens the agent against similar issues.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.52.0 | 0.52.0 |
