Live › vulnerability › CVE-2026-94444
Go to dashboardcmd/go could be made to accept a substituted golang.org/fips140 module. The attacker needs a malicious Go project with a bogus golang.org/fips140 and a malicious GOMODPROXY that the user chooses to connect to. The module then passes checksum verification. Fixed by unpacking the bundled trusted ziphash for the module into GOMODCACHE. Released in Go 1.26.9 and 1.27.2 on 2026-10-08, together with 14 other fixes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| toolchain | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
| go:toolchain | go | < 1.26.9; >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
go version (and go env GOTOOLCHAIN)1.26.9 or go1.27.0/1.27.1, and you build untrusted Go projects with a GOPROXY/GOMODPROXY you do not control1.26.9 or 1.27.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.
We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
This page as .md · .json · in your agent: get_signal("CVE-2026-94444")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.