CVE-2026-94444

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: Go Project

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94444

EUVD

EUVD-2026-95417

Affected Vendors & Products

Vendor	Product	Version / Range
Go	toolchain	cmd/go 0
Go	toolchain	cmd/go 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious Go project that defines a fake golang.org/fips140 module and operates a rogue GOMODPROXY server. The attacker can trick the Go toolchain into downloading and using a malicious module instead of the legitimate one by manipulating the module cache verification process.

Detection Guidance

This vulnerability involves a malicious Go module proxy serving arbitrary modules. To detect it, inspect Go module dependencies for unexpected or untrusted modules, particularly those claiming to be golang.org/fips140. Check GOMODCACHE for inconsistencies in module hashes or unexpected module entries.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system by replacing a trusted Go module with a malicious one. This could lead to data breaches, unauthorized access, or further compromise of your development environment.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to module verification in the Go toolchain rather than data protection or privacy controls.

Mitigation Strategies

Avoid using untrusted Go modules or GOMODPROXY servers. Verify module sources and hashes before installation. Use official Go toolchain sources only.

Hi! I’m here to help you understand CVE-2026-94444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70