CVE-2026-42501
Go Toolchain Validation Bypass via Malicious Module Proxy
Publication date: 2026-05-07
Last updated on: 2026-05-08
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | From 1.26.0 (inc) to 1.26.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability (CVE-2026-42501) affects the Go toolchain's command (`cmd/go`) and involves a flaw in how the go command validates module checksums when downloading modules or toolchains from a module proxy or checksum database.
A malicious module proxy can exploit this flaw to bypass checksum database validation by returning a successful response that contains no entry for the module, or an unrelated module entry, causing the go command to incorrectly accept the module as valid.
This allows the proxy to serve altered versions of the Go toolchain or modules, potentially compromising the integrity of the downloaded code.
Users relying on untrusted module proxies (GOMODPROXY) or checksum databases (GOSUMDB) are vulnerable, and simply setting the GOTOOLCHAIN environment variable to a fixed version is not sufficient to mitigate the risk.
To detect if a module has been altered, users can run the commands "rm go.sum ; go mod tidy ; go mod verify" to revalidate all dependencies.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a malicious module proxy to serve altered or tampered versions of the Go toolchain or modules without proper checksum validation.
If exploited, it could lead to execution of compromised code during the build or execution process, potentially introducing security risks such as unauthorized code execution, data corruption, or other malicious behavior.
Because the go command trusts the go.sum file for module hashes, a malicious proxy could cause incorrect hashes to be recorded, further compromising the integrity of your dependencies.
Even users who set the GOTOOLCHAIN environment variable to a fixed version remain at risk unless they upgrade their base Go toolchain to a fixed version that rejects altered cached toolchains.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Users who have configured a non-trusted GOPROXY can determine if they have been affected by revalidating all dependencies of the current module.
To check for potential exploitation, run the following commands:
- rm go.sum
- go mod tidy
- go mod verify
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade your base Go toolchain to a fixed version that properly verifies checksum database responses.
Setting the GOTOOLCHAIN environment variable to a fixed version is not sufficient by itself.
The fixed versions of the Go tool will refuse to execute any cached, altered versions of the toolchain, ensuring security.