When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade criu-libsUpgrade podman-remoteUpgrade libslirpUpgrade libslirp-develUpgrade podman-pluginsUpgrade containers-commonUpgrade skopeo-testsUpgrade crunUpgrade conmonUpgrade critUpgrade criu-develUpgrade runcUpgrade python3-criuUpgrade udicaUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade podmanUpgrade buildahUpgrade podman-testsUpgrade toolboxUpgrade netavarkUpgrade skopeoUpgrade cockpit-podmanUpgrade criuUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade podman-dockerUpgrade toolbox-testsUpgrade python3-podman | Jul 7, 2026 | Jul 6, 2026 |
| Amazon Linux Ami 2 | — | Upgrade nerdctlUpgrade runfinch-finchUpgrade containerd-stressUpgrade containerdUpgrade nerdctl-debuginfoUpgrade amazon-cloudwatch-agentUpgrade containerd-debuginfo | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade rcloneUpgrade containerd-stress-debuginfoUpgrade amazon-cloudwatch-agentUpgrade runfinch-finchUpgrade containerdUpgrade containerd-debuginfoUpgrade nerdctlUpgrade rclone-debugsourceUpgrade containerd-stressUpgrade containerd-debugsourceUpgrade rclone-debuginfo | Jun 9, 2026 | May 22, 2026 |
| Redhat_linux | — | Upgrade runcUpgrade podman-testsUpgrade toolbox-debugsourceUpgrade buildah-tests-debuginfoUpgrade containernetworking-pluginsUpgrade toolboxUpgrade python3-podmanUpgrade podman-dockerUpgrade containernetworking-plugins-debugsourceUpgrade udicaUpgrade criuUpgrade podman-catatonitUpgrade skopeoUpgrade buildah-debuginfoUpgrade buildahUpgrade buildah-testsUpgrade podmanUpgrade podman-tests-debuginfoUpgrade critUpgrade netavarkUpgrade buildah-debugsourceUpgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade conmonUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade criu-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade criu-debuginfoUpgrade flightctl-selinuxUpgrade aardvark-dnsUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade slirp4netns-debuginfoUpgrade flightctl-observabilityUpgrade container-selinuxUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade flightctl-cliUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade criu-develUpgrade podman-gvproxyUpgrade crunUpgrade flightctl-servicesUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade flightctl-agentUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade podman-pluginsUpgrade slirp4netns-debugsource | Jul 8, 2026 | May 22, 2026 |
| Rocky_linux | — | Upgrade crunUpgrade podman-pluginsUpgrade conmon-debugsourceUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade toolbox-debuginfoUpgrade buildah-debuginfoUpgrade libslirpUpgrade aardvark-dnsUpgrade buildah-testsUpgrade buildahUpgrade libslirp-debugsourceUpgrade crun-debuginfoUpgrade runc-debugsourceUpgrade podman-tests-debuginfoUpgrade podman-testsUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade python3-criuUpgrade toolbox-testsUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade conmonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade runcUpgrade skopeo-testsUpgrade buildah-debugsourceUpgrade criuUpgrade podman-debuginfoUpgrade toolbox-debugsourceUpgrade criu-libsUpgrade netavarkUpgrade fuse-overlayfs-debugsourceUpgrade podman-remoteUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runc-debuginfoUpgrade containers-commonUpgrade crun-debugsourceUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-pluginsUpgrade critUpgrade fuse-overlayfsUpgrade libslirp-devel | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade golang-go.crypto-dev (Ubuntu Pro)Upgrade golang-golang-x-crypto-dev (Ubuntu Pro) | Jun 18, 2026 | Jun 17, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub