CVE-2026-94444
published 2026-10-08CVE-2026-94444: Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.09%
0.6th percentile
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_toolchain | cmd_go | < 1.26.9 | 1.26.9 |
| go_toolchain | cmd_go | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| mta | mta-go-external-provider-rhel9 | — | — |
| openshift4 | ose-operator-sdk-rhel8 | — | — |
| openshift4 | ose-operator-sdk-rhel9 | — | — |
| ubi10 | go-toolset | — | — |
| ubi8 | go-toolset | — | — |
| ubi9 | go-toolset | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
vendor_redhat·2026-10-08·CVSS 6.7
CVE-2026-94444 [MEDIUM] CWE-354 cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy (GOMODPROXY), the proxy can serve an arbitrary replacement module that still passes local verification. This can lead to arbitrary code execution during Go build or module download operations.
Statement: This issue is rated Moderate. Exploitation requires a developer to operate inside a maliciously crafted Go project and to use an untrusted module proxy. The golang toolchain is primarily a development and build-time component, and this is not a typical Red Hat product runtime configuration. Successful exploitation can result in a
GHSA
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module i
ghsa_unreviewed·2026-10-09
CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module i
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
VulDB
cmd go up to 1.26.8/1.27.1 GOMODPROXY integrity check (EUVD-2026-95417)
vuldb·2026-10-09
CVE-2026-94444 [CRITICAL] cmd go up to 1.26.8/1.27.1 GOMODPROXY integrity check (EUVD-2026-95417)
A vulnerability was found in cmd go up to 1.26.8/1.27.1. It has been declared as critical. This issue affects some unknown processing of the component GOMODPROXY Handler. Such manipulation leads to improper validation of integrity check value.
This vulnerability is traded as CVE-2026-94444. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94444 golang: cmd/go: arbitrary code execution via untrusted module proxy [fedora-all]
bugzilla·2026-10-09
CVE-2026-94444 [MEDIUM] CVE-2026-94444 golang: cmd/go: arbitrary code execution via untrusted module proxy [fedora-all]
CVE-2026-94444 golang: cmd/go: arbitrary code execution via untrusted module proxy [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Bugzilla
CVE-2026-94444 cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
bugzilla·2026-10-08
CVE-2026-94444 [MEDIUM] CVE-2026-94444 cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
CVE-2026-94444 cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Discussion:
CVSS Justification
AV:L -- Exploitation requires running the local go command on the victim host.
AC:H -- Attacker must supply a malicious Go project and the user must also use an untrusted module proxy.
PR:L -- A local account (developer/build user) is required to invoke the go toolchain; an unauthenticated remote
2026-10-08
Published