CVE-2026-94447
published 2026-10-08CVE-2026-94447: Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.10%
0.9th percentile
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | udi-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_toolchain | cmd_go | < 1.26.9 | 1.26.9 |
| go_toolchain | cmd_go | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| mta | mta-go-external-provider-rhel9 | — | — |
| openshift4 | ose-operator-sdk-rhel8 | — | — |
| openshift4 | ose-operator-sdk-rhel9 | — | — |
| ubi10 | go-toolset | — | — |
| ubi8 | go-toolset | — | — |
| ubi9 | go-toolset | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Google cmd/go up to 1.26.8/1.27.1 GOMODPROXY go.sum integrity check (EUVD-2026-95418)
vuldb·2026-10-09
CVE-2026-94447 [CRITICAL] Google cmd/go up to 1.26.8/1.27.1 GOMODPROXY go.sum integrity check (EUVD-2026-95418)
A vulnerability was found in Google cmd and go up to 1.26.8/1.27.1. It has been classified as critical. This vulnerability affects unknown code of the file go.sum of the component GOMODPROXY Handler. This manipulation causes improper validation of integrity check value.
This vulnerability appears as CVE-2026-94447. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended
ghsa_unreviewed·2026-10-09
CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Red Hat
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
vendor_redhat·2026-10-08·CVSS 6.7
CVE-2026-94447 [MEDIUM] CWE-354 cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be downloaded and executed.
Statement: This issue is rated Moderate. Exploitation requires a developer to operate inside a maliciously crafted Go project and to use an untrusted module proxy. The golang toolchain is primarily a development and build-time component, and this is not a typical Red Hat product runtime configuration. Successful exploitation can result in execution of a tampered Go toolchain as t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94447 golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration [fedora-all]
bugzilla·2026-10-09
CVE-2026-94447 [MEDIUM] CVE-2026-94447 golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration [fedora-all]
CVE-2026-94447 golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Bugzilla
CVE-2026-94447 cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
bugzilla·2026-10-08
CVE-2026-94447 [MEDIUM] CVE-2026-94447 cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
CVE-2026-94447 cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Discussion:
CVSS Justification
AV:L -- Exploitation requires running the local go command on the victim host.
AC:H -- Attacker must supply a malicious Go project and the user must also use an untrusted module proxy.
PR:L -- A local account (developer/build user) is required to invoke the go toolchain; an unauthenticated remote party cannot trigger the flaw on its own.
UI:R --
2026-10-08
Published