CVE-2026-94447

Received Received - Intake

Go Toolchain Checksum Bypass Vulnerability

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Go Project

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-94447

EUVD

EUVD-2026-95418

Affected Vendors & Products

Vendor	Product	Version / Range
Go	toolchain	cmd/go 0
Go	toolchain	cmd/go 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a bypass in the Go toolchain's checksum verification. A malicious Go project could define a fake golang.org/toolchain entry in go.sum and use a compromised GOMODPROXY to trick the system into accepting incorrect checksums. The fix ensures golang.org/toolchain always fetches the correct checksum from the network.

Impact Analysis

If exploited, this vulnerability could allow an attacker to inject malicious code or dependencies into a Go project by bypassing checksum validation. This might lead to supply chain attacks, unauthorized code execution, or compromised software builds.

Mitigation Strategies

Update the Go toolchain to the latest version to ensure the fix for the checksum bypass is applied. Verify that all go.sum entries for golang.org/toolchain are valid and not tampered with.

Hi! I’m here to help you understand CVE-2026-94447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70