{"id":"CVE-2026-94444","kind":"vulnerability","aliases":["CVE-2026-94444","GO-2026-6601"],"related":[],"title":"Checksum bypass for golang.org/fips140 in cmd/go","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.\n\nWe now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.","summary":"cmd/go could be made to accept a substituted golang.org/fips140 module. The attacker needs a malicious Go project with a bogus golang.org/fips140 and a malicious GOMODPROXY that the user chooses to connect to. The module then passes checksum verification. Fixed by unpacking the bundled trusted ziphash for the module into GOMODCACHE. Released in Go 1.26.9 and 1.27.2 on 2026-10-08, together with 14 other fixes.","severity":"high","cvss":7.8,"epss":0.00094,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"},{"name":"go:toolchain","fixed":["1.26.9","1.27.2"],"affected":"< 1.26.9; >= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci","cmd-go","developers","go","golang","runtime","supply-chain"],"not_affected_if":["default-config","go-toolchain-below-1.27.0","no-untrusted-projects","no-untrusted-projects-built","trusted-module-proxy-only"],"how_to_check":"Run 'go version' (and 'go env GOTOOLCHAIN'). You are exposed if it reports go1.26.x below 1.26.9 or go1.27.0/1.27.1, and you build untrusted Go projects with a GOPROXY/GOMODPROXY you do not control. CI images and Dockerfiles that pin golang:1.26.x or 1.27.x should be checked as well.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 or later. Until then, do not build untrusted projects with a non-default GOPROXY.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:55+00:00","updated_at":"2026-10-23T21:43:32+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:52:55Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 or later, for the affected 1.27.0-0 through below 1.27.2 range.\nunknown","summary":"The Go toolchain's cmd/go could be tricked into accepting a substituted golang.org/fips140 module when a user works inside a malicious Go project and connects to a malicious module proxy. An attacker serving that proxy can get arbitrary code from a module into the build while it passes checksum verification.","category":"runtime","who_cares":["go","golang","developers","ci"],"confidence":0.6,"analyst_note":"Confirm the affected range for the 1.26.x line (the fixed 1.26.9 implies earlier 1.26 releases are affected) and find a concrete check command at https://pkg.go.dev/vuln/GO-2026-6601.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["go-toolchain-below-1.27.0","trusted-module-proxy-only","no-untrusted-projects-built"],"severity_if_unknown":"high"},"cost_usd":0.000402,"input_tokens":2153,"output_tokens":373,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected range for the 1.26.x line (the fixed 1.26.9 implies earlier 1.26 releases are affected) and find a concrete check command at https://pkg.go.dev/vuln/GO-2026-6601.","search":"'-08':95B '-10':94B '-2026':10A,13A,16A '-6601':14A '-94444':11A,17A '/fips140':6A,42B,56B,117C,148C '1.26.9':89B '1.27.2':91B '14':98B '2026':93B 'accept':37B 'arbitrari':132C 'attack':45B 'bogus':53B,114C 'bundl':78B,145C 'bypass':2A 'chain':31B 'checksum':1A,72B 'choos':64B,125C 'ci':21B 'cmd':23B 'cmd-go':22B 'cmd/go':8A,32B 'connect':66B,127C 'construct':151C 'could':33B 'cve':9A,15A 'defin':112C 'develop':25B 'entri':153C 'fix':74B,100B 'go':12A,19A,24B,26B,49B,88B,109C 'golang':27B 'golang.org':5A,41B,55B,116C,147C 'golang.org/fips140':4A,40B,54B,115C,146C 'gomodcach':85B,156C 'gomodproxi':60B,122C 'insid':105C 'made':35B 'malici':48B,59B,108C,121C 'modul':43B,69B,83B,133C,149C 'need':46B 'oper':104C,119C 'pass':71B 'place':136C 'previous':101C 'project':50B,110C 'releas':86B 'runtim':28B 'serv':130C 'substitut':39B 'suppli':30B 'supply-chain':29B 'togeth':96B 'toolchain':18A,20A,165C 'trust':79B,141C 'unpack':76B,139C 'user':63B,103C,124C 'verif':73B 'verifi':162C 'ziphash':80B,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6601","url":"https://pkg.go.dev/vuln/GO-2026-6601","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94444","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94444","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94444","severity":null,"published_at":"2026-10-08T23:17:05+00:00","modified_at":"2026-10-15T16:18:24+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94444:138","url":null,"severity":null,"published_at":"2026-10-23T21:43:32+00:00","modified_at":"2026-10-23T21:43:32+00:00","first_seen_at":"2026-10-23T21:43:32+00:00","fetched_at":"2026-10-23T21:43:32+00:00","note":"Read Go vuln report GO-2026-6601, golang-announce 1.27.2/1.26.9 post and go.dev/issue/81833. Affected: cmd/go before 1.26.9 and 1.27.0-0 to before 1.27.2; the report gives no lower bound for 1.26, so 'all earlier 1.26' is unconfirmed. No exploitation or PoC found; I did not search social posts."}],"documents":[{"id":1222,"url":"https://pkg.go.dev/vuln/GO-2026-6601","title":"GO-2026-6601 Go vulnerability report","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1224,"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","title":"[security] Go 1.27.2 and Go 1.26.9 are released","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1225,"url":"https://go.dev/issue/81833","title":"cmd/go: malicious GOMODPROXY can cause golang.org/fips140 checksum bypass","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}