When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-podmanUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade buildah-testsUpgrade criuUpgrade toolboxUpgrade podman-catatonitUpgrade podmanUpgrade slirp4netnsUpgrade netavarkUpgrade podman-dockerUpgrade podman-testsUpgrade buildahUpgrade fuse-overlayfsUpgrade crunUpgrade libslirpUpgrade critUpgrade libslirp-develUpgrade runcUpgrade criu-develUpgrade skopeo-testsUpgrade container-selinuxUpgrade podman-pluginsUpgrade podman-remoteUpgrade udicaUpgrade containers-commonUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade criu-libs | Jul 7, 2026 | Jul 6, 2026 |
| Amazon Linux Ami 2 | — | Upgrade runfinch-finchUpgrade nerdctlUpgrade containerd-stressUpgrade amazon-cloudwatch-agentUpgrade nerdctl-debuginfoUpgrade containerd-debuginfoUpgrade containerd | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade nerdctlUpgrade containerd-debugsourceUpgrade rclone-debuginfoUpgrade containerd-stressUpgrade rclone-debugsourceUpgrade rcloneUpgrade amazon-cloudwatch-agentUpgrade containerdUpgrade containerd-stress-debuginfoUpgrade runfinch-finchUpgrade containerd-debuginfo | Jun 9, 2026 | May 22, 2026 |
| Redhat_linux | — | Upgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-develUpgrade libslirp-debugsourceUpgrade container-selinuxUpgrade flightctl-observabilityUpgrade criu-libsUpgrade criu-develUpgrade crun-debuginfoUpgrade podman-gvproxyUpgrade crun-debugsourceUpgrade podman-debugsourceUpgrade crunUpgrade flightctl-servicesUpgrade python3-criuUpgrade flightctl-cliUpgrade conmon-debuginfoUpgrade libslirpUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade flightctl-agentUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade slirp4netnsUpgrade containers-commonUpgrade netavarkUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade podman-remoteUpgrade podman-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildah-tests-debuginfoUpgrade udicaUpgrade toolboxUpgrade criu-debuginfoUpgrade buildah-testsUpgrade runcUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade conmonUpgrade toolbox-debugsourceUpgrade flightctl-selinuxUpgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade buildahUpgrade skopeoUpgrade critUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade podmanUpgrade podman-tests-debuginfoUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade python3-podmanUpgrade podman-catatonit | Jul 8, 2026 | May 22, 2026 |
| Rocky_linux | — | Upgrade crun-debuginfoUpgrade buildahUpgrade podman-tests-debuginfoUpgrade buildah-testsUpgrade slirp4netnsUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade libslirpUpgrade toolbox-debuginfoUpgrade buildah-tests-debuginfoUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade podman-testsUpgrade libslirp-debuginfoUpgrade criu-debuginfoUpgrade toolbox-testsUpgrade criu-debugsourceUpgrade criu-develUpgrade criuUpgrade toolbox-debugsourceUpgrade podman-debuginfoUpgrade criu-libsUpgrade netavarkUpgrade skopeo-testsUpgrade podman-remoteUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-develUpgrade critUpgrade containernetworking-plugins-debugsourceUpgrade runcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade buildah-debugsourceUpgrade containers-commonUpgrade podmanUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade toolboxUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade conmon-debugsourceUpgrade skopeoUpgrade slirp4netns-debugsourceUpgrade crun-debugsource | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade golang-go.crypto-dev (Ubuntu Pro)Upgrade golang-golang-x-crypto-dev (Ubuntu Pro) | Jun 18, 2026 | Jun 17, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub