---
id: "CVE-2026-94447"
kind: "vulnerability"
aliases: ["CVE-2026-94447", "GO-2026-6602"]
title: "Checksum database bypass for golang.org/toolchain in cmd/go"
severity: "high"
cvss: 7.8
epss: 0.00103
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci", "developers", "go", "golang", "runtime"]
not_affected_if: ["default-proxy-only", "go-not-used", "trusted-projects-only"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:52:56+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6602", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94447", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94447", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Checksum database bypass for golang.org/toolchain in cmd/go

The Go toolchain's cmd/go could accept a checksum for golang.org/toolchain from a malicious project's go.sum and a malicious module proxy, bypassing checksum verification. An attacker who gets a developer to work inside a crafted Go project and use a hostile GOMODPROXY can have a tampered toolchain trusted in place of the genuine one.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Run go version and compare against the fixed releases (1.26.9 or 1.27.2 or later).
Check GOMODPROXY (go env GOMODPROXY) for any proxy the team did not set deliberately.

## Fix

Upgrade the Go toolchain to 1.26.9 or 1.27.2 (affected range is >= 1.27.0-0 and < 1.27.2).
Only use trusted GOMODPROXY values and do not open untrusted Go projects with custom proxy settings.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6602
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94447
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94447

## From the sources

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.

We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_