---
id: "CVE-2026-94444"
kind: "vulnerability"
aliases: ["CVE-2026-94444", "GO-2026-6601"]
title: "Checksum bypass for golang.org/fips140 in cmd/go"
severity: "high"
cvss: 7.8
epss: 0.00094
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}, {"name": "go:toolchain", "fixed": ["1.26.9", "1.27.2"], "affected": "< 1.26.9; >= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci", "cmd-go", "developers", "go", "golang", "runtime", "supply-chain"]
not_affected_if: ["default-config", "go-toolchain-below-1.27.0", "no-untrusted-projects", "no-untrusted-projects-built", "trusted-module-proxy-only"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:32+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6601", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94444", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94444", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:43:32+00:00"}]
---

# Checksum bypass for golang.org/fips140 in cmd/go

cmd/go could be made to accept a substituted golang.org/fips140 module. The attacker needs a malicious Go project with a bogus golang.org/fips140 and a malicious GOMODPROXY that the user chooses to connect to. The module then passes checksum verification. Fixed by unpacking the bundled trusted ziphash for the module into GOMODCACHE. Released in Go 1.26.9 and 1.27.2 on 2026-10-08, together with 14 other fixes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2
- go:go:toolchain affected < 1.26.9; >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Run 'go version' (and 'go env GOTOOLCHAIN'). You are exposed if it reports go1.26.x below 1.26.9 or go1.27.0/1.27.1, and you build untrusted Go projects with a GOPROXY/GOMODPROXY you do not control. CI images and Dockerfiles that pin golang:1.26.x or 1.27.x should be checked as well.

## Fix

Upgrade the Go toolchain to 1.26.9 or 1.27.2 or later. Until then, do not build untrusted projects with a non-default GOPROXY.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6601
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94444
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94444
- 2026-10-23T21:43:32+00:00 analyst — Read Go vuln report GO-2026-6601, golang-announce 1.27.2/1.26.9 post and go.dev/issue/81833. Affected: cmd/go before 1.26.9 and 1.27.0-0 to before 1.27.2; the report gives no lower bound for 1.26, so 'all earlier 1.26' is unconfirmed. No exploitation or PoC found; I did not search social posts.

## Documents

- [advisory] GO-2026-6601 Go vulnerability report https://pkg.go.dev/vuln/GO-2026-6601
- [describes] cmd/go: malicious GOMODPROXY can cause golang.org/fips140 checksum bypass https://go.dev/issue/81833
- [fix] [security] Go 1.27.2 and Go 1.26.9 are released https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

## From the sources

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.

We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_