CVE-2026-39832

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Al añadir una clave a un agente remoto, las extensiones de restricción como [email protected] no se serializaban en la solicitud. Las restricciones de destino se eliminaban silenciosamente al reenviar claves, permitiendo el uso sin restricciones de la clave en el host remoto. El cliente ahora serializa todas las extensiones de restricción. Además, el llavero en memoria devuelto por NewKeyring() ahora rechaza las claves con extensiones de restricción no compatibles en lugar de ignorarlas silenciosamente.