{"id":"GO-2026-6893","kind":"vulnerability","aliases":["GO-2026-6893"],"related":[],"title":"Event type spoofing via UntrustedType in github.com/google/go-eventlog","description":"In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.","summary":"In github.com/google/go-eventlog/tcg, the UntrustedType method returns the event type from the TCG event log without checking it against the event's digest. A caller that dispatches on that type after ParseAndReplay can be misled by a modified event type field.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/google/go-eventlog","fixed":["0.0.3-0.20261001001437-1991f15bc4b0"],"affected":"< 0.0.3-0.20261001001437-1991f15bc4b0","ecosystem":"go"}],"ecosystems":["go"],"tags":["attestation","go","go-eventlog","package","tpm"],"not_affected_if":["does-not-import-tcg","no-untrustedtype-dispatch"],"how_to_check":"- Search the Go code for `UntrustedType` and `ParseAndReplay` from `github.com/google/go-eventlog/tcg`.\n- Check the module version in `go.mod` for `github.com/google/go-eventlog` against the fixed version below.","fix":"- `github.com/google/go-eventlog` `0.0.3-0.20261001001437-1991f15bc4b0`","status":"open","published_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","triaged_at":"2026-11-06T00:10:29+00:00","updated_at":"2026-11-06T00:10:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T00:10:29Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/google/go-eventlog` `0.0.3-0.20261001001437-1991f15bc4b0`","reach":"unknown","title":"go-eventlog: unverified event type lets callers be spoofed","impact":"medium","summary":"In github.com/google/go-eventlog/tcg, the UntrustedType method returns the event type from the TCG event log without checking it against the event's digest. A caller that dispatches on that type after ParseAndReplay can be misled by a modified event type field.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","go-eventlog","tpm","attestation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Event type checks can be bypassed, changing how attestation logic treats events","analyst_note":"","how_to_check":"- Search the Go code for `UntrustedType` and `ParseAndReplay` from `github.com/google/go-eventlog/tcg`.\n- Check the module version in `go.mod` for `github.com/google/go-eventlog` against the fixed version below.","plain_action":"","needs_analyst":false,"not_affected_if":["does-not-import-tcg","no-untrustedtype-dispatch"],"who_is_affected":"Only Go programs that import github.com/google/go-eventlog/tcg, call ParseAndReplay, and make decisions based on Event.UntrustedType. Code that does not dispatch on that field, or that verifies event digests itself, is less exposed. Teams that do not use this package can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000713,"input_tokens":4282,"output_tokens":569,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-6893':12A,15A '/google/go-eventlog':9A,18A '/google/go-eventlog/tcg,':29B,71C 'attest':19B 'caller':51B,96C 'check':43B 'data':92C 'digest':49B,95C,115C 'dispatch':53B,98C 'event':1A,35B,40B,47B,65B,72C,79C,85C,91C,109C,113C 'event.untrustedtype':100C 'eventdata':120C 'eventlog':23B 'expos':73C 'field':67B,111C 'github.com':8A,17A,28B,70C 'github.com/google/go-eventlog':7A,16A 'github.com/google/go-eventlog/tcg,':27B,69C 'go':10A,13A,20B,22B 'go-eventlog':21B 'header':81C 'log':41B,86C 'match':93C 'method':32B 'misl':61B 'modifi':64B,108C 'packag':24B 'parseandreplay':58B,102C 'raw':78C 'return':33B,76C 'spoof':3A 'tcg':39B,84C 'tpm':25B 'trick':105C 'type':2A,36B,56B,66B,80C,110C 'untrustedtyp':5A,31B,74C 'verifi':88C,118C 'via':4A 'whose':114C 'without':42B,87C","nicknames":[],"mitigations":[],"who_affected":"Only Go programs that import github.com/google/go-eventlog/tcg, call ParseAndReplay, and make decisions based on Event.UntrustedType. Code that does not dispatch on that field, or that verifies event digests itself, is less exposed. Teams that do not use this package can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomgooglegoeventlog"],"ptokens":["com","eventlog","github","go","google"],"labels":["attestation","go","goeventlog","low","package","tpm"],"campaign_type":null,"first_public_at":"2026-11-05T22:55:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6893","url":"https://pkg.go.dev/vuln/GO-2026-6893","severity":null,"published_at":"2026-11-05T22:55:15+00:00","modified_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","fetched_at":"2026-11-06T00:09:14+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}