Live › vulnerability › CVE-2026-94447
Go to dashboardThe Go toolchain's cmd/go could accept a checksum for golang.org/toolchain from a malicious project's go.sum and a malicious module proxy, bypassing checksum verification. An attacker who gets a developer to work inside a crafted Go project and use a hostile GOMODPROXY can have a tampered toolchain trusted in place of the genuine one.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| toolchain | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
1.26.9 or 1.27.2 or later)1.26.9 or 1.27.2 (affected range is >= and < )1.27.0-01.27.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.
We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
This page as .md · .json · in your agent: get_signal("CVE-2026-94447")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.