CVE-2026-94444

Received Received - Intake

Malicious Module Spoofing in Go Toolchain

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Go Project

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-94444

EUVD

EUVD-2026-95417

Affected Vendors & Products

Vendor	Product	Version / Range
Go	toolchain	cmd/go 0
Go	toolchain	cmd/go 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious Go project that defines a fake golang.org/fips140 module and operates a rogue GOMODPROXY server. The attacker can trick the Go toolchain into downloading and using a malicious module instead of the legitimate one by manipulating the module cache verification process.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system by replacing a trusted Go module with a malicious one. This could lead to data breaches, unauthorized access, or further compromise of your development environment.

Mitigation Strategies

Avoid using untrusted Go modules or GOMODPROXY servers. Verify module sources and hashes before installation. Use official Go toolchain sources only.

Hi! I’m here to help you understand CVE-2026-94444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70