CVE-2026-94447

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: Go Project

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94447

EUVD

EUVD-2026-95418

Affected Vendors & Products

Vendor	Product	Version / Range
Go	toolchain	cmd/go 0
Go	toolchain	cmd/go 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-354	The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

Executive Summary

This vulnerability involves a bypass in the Go toolchain's checksum verification. A malicious Go project could define a fake golang.org/toolchain entry in go.sum and use a compromised GOMODPROXY to trick the system into accepting incorrect checksums. The fix ensures golang.org/toolchain always fetches the correct checksum from the network.

Detection Guidance

This vulnerability involves a bypass of checksum verification in Go projects using malicious go.sum entries and a compromised GOMODPROXY. Detection requires checking for unexpected network requests to golang.org/toolchain and verifying go.sum integrity. Inspect go.sum files for entries related to golang.org/toolchain and monitor network traffic for unauthorized checksum requests.

Impact Analysis

If exploited, this vulnerability could allow an attacker to inject malicious code or dependencies into a Go project by bypassing checksum validation. This might lead to supply chain attacks, unauthorized code execution, or compromised software builds.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to Go toolchain checksum bypasses in malicious projects. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Update the Go toolchain to the latest version to ensure the fix for the checksum bypass is applied. Verify that all go.sum entries for golang.org/toolchain are valid and not tampered with.

Hi! I’m here to help you understand CVE-2026-94447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70