{"id":"CVE-2026-123508","kind":"vulnerability","aliases":["CVE-2026-123508"],"related":[],"title":"Vikunja: release build fetches mutable xgo references, enabling signed malicious binaries","description":"Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.","summary":"Vikunja's release build tooling pulls the xgo module and Docker image by mutable latest tags rather than pinned versions. An attacker who compromises those upstream sources could get malicious code into release binaries that still carry a valid Vikunja signature.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","package","release-engineering","self-hosted","vikunja"],"not_affected_if":["no-source-build","official-binaries-only"],"how_to_check":"- Check the Vikunja version in use with `vikunja version` or the release tag, and confirm it is below `2.7.1`.\n- Only teams that build Vikunja release binaries themselves with the mage release targets are relevant; running an official release binary is not covered by this description.","fix":"- Vikunja versions before `2.7.1` are affected; move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:26:44+00:00","updated_at":"2026-11-08T02:26:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja versions before `2.7.1` are affected; move to `2.7.1` or later.","reach":"unknown","title":"Vikunja: release build fetches mutable xgo references, enabling signed malicious binaries","impact":"high","summary":"Vikunja's release build tooling pulls the xgo module and Docker image by mutable latest tags rather than pinned versions. An attacker who compromises those upstream sources could get malicious code into release binaries that still carry a valid Vikunja signature.","audience":"developers","category":"package","nicknames":[],"who_cares":["vikunja","go","release-engineering","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"malicious code ends up in signed release binaries built from source","analyst_note":"","how_to_check":"- Check the Vikunja version in use with `vikunja version` or the release tag, and confirm it is below `2.7.1`.\n- Only teams that build Vikunja release binaries themselves with the mage release targets are relevant; running an official release binary is not covered by this description.","plain_action":"","needs_analyst":false,"not_affected_if":["official-binaries-only","no-source-build"],"who_is_affected":"The risk sits in the build pipeline: teams that compile Vikunja release binaries from source using its mage release targets fetch the xgo module and Docker image at build time. Teams that only deploy published, already-built Vikunja releases are not described as exposed. unknown for whether published official binaries were affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":4272,"output_tokens":556,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123508':14A,17A '-2026':13A,16A '2.7.1':70C 'attack':48B,93C 'binari':11A,60B,111C 'build':3A,30B 'built':109C 'carri':63B 'chain':74C 'code':57B,106C 'compromis':50B,95C 'contain':71C 'could':54B 'cve':12A,15A 'docker':37B,87C 'enabl':8A 'engin':22B 'fetch':4A,82C 'get':55B 'go':18B 'host':25B 'imag':38B,88C,100C 'inject':104C 'latest':41B,91C 'mage':78C 'malici':10A,56B,105C 'modul':35B,85C,99C 'mutabl':5A,40B,90C 'packag':19B 'pin':45B 'pull':32B 'rather':43B 'refer':7A,92C 'registri':102C 'releas':2A,21B,29B,59B,79C,110C 'release-engin':20B 'self':24B 'self-host':23B 'ship':112C 'sign':9A 'signatur':67B,116C 'sourc':53B 'still':62B 'subsequ':108C 'suppli':73C 'tag':42B 'target':80C 'tool':31B 'upstream':52B,97C 'valid':65B,115C 'version':46B 'vikunja':1A,26B,27B,66B,68C 'vulner':75C 'xgo':6A,34B,84C,98C","nicknames":[],"mitigations":[],"who_affected":"The risk sits in the build pipeline: teams that compile Vikunja release binaries from source using its mage release targets fetch the xgo module and Docker image at build time. Teams that only deploy published, already-built Vikunja releases are not described as exposed. unknown for whether published official binaries were affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["go","low","package","releaseengineering","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123508':14A,17A '-2026':13A,16A 'binari':11A 'build':3A 'cve':12A,15A 'enabl':8A 'fetch':4A 'malici':10A 'mutabl':5A 'refer':7A 'releas':2A 'sign':9A 'vikunja':1A 'xgo':6A","search_b":"'attack':48B 'binari':60B 'build':30B 'carri':63B 'code':57B 'compromis':50B 'could':54B 'docker':37B 'engin':22B 'get':55B 'go':18B 'host':25B 'imag':38B 'latest':41B 'malici':56B 'modul':35B 'mutabl':40B 'packag':19B 'pin':45B 'pull':32B 'rather':43B 'releas':21B,29B,59B 'release-engin':20B 'self':24B 'self-host':23B 'signatur':67B 'sourc':53B 'still':62B 'tag':42B 'tool':31B 'upstream':52B 'valid':65B 'version':46B 'vikunja':26B,27B,66B 'xgo':34B","search_c":"'2.7.1':70C 'attack':93C 'binari':111C 'built':109C 'chain':74C 'code':106C 'compromis':95C 'contain':71C 'docker':87C 'fetch':82C 'imag':88C,100C 'inject':104C 'latest':91C 'mage':78C 'malici':105C 'modul':85C,99C 'mutabl':90C 'refer':92C 'registri':102C 'releas':79C,110C 'ship':112C 'signatur':116C 'subsequ':108C 'suppli':73C 'target':80C 'upstream':97C 'valid':115C 'vikunja':68C 'vulner':75C 'xgo':84C,98C","first_public_at":"2026-10-22T10:03:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123508","severity":null,"published_at":"2026-11-08T02:16:39+00:00","modified_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99165,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h8wj-3gwg-jjjg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:03:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99166,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-supply-chain-risk-via-unpinned-xgo-release-toolchain","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}