---
id: "CVE-2026-123508"
page: "https://infrastack.ai/live/CVE-2026-123508"
kind: "vulnerability"
aliases: ["CVE-2026-123508"]
title: "Vikunja: release build fetches mutable xgo references, enabling signed malicious binaries"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "package", "release-engineering", "self-hosted", "vikunja"]
not_affected_if: ["no-source-build", "official-binaries-only"]
published_at: "2026-11-08T02:16:39+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:26:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123508", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: release build fetches mutable xgo references, enabling signed malicious binaries

Link for people: https://infrastack.ai/live/CVE-2026-123508 (this .md is for agents)

Vikunja's release build tooling pulls the xgo module and Docker image by mutable latest tags rather than pinned versions. An attacker who compromises those upstream sources could get malicious code into release binaries that still carry a valid Vikunja signature.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version in use with `vikunja version` or the release tag, and confirm it is below `2.7.1`.
- Only teams that build Vikunja release binaries themselves with the mage release targets are relevant; running an official release binary is not covered by this description.

## Fix

- Vikunja versions before `2.7.1` are affected; move to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123508

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h8wj-3gwg-jjjg
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-supply-chain-risk-via-unpinned-xgo-release-toolchain

## From the sources

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_