CVE-2026-94447
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Previously, a user operating inside a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY could bypass the intended checksum. It is now ensured that golang.org/toolchain always goes to the network for the canonical checksum.
Risk Assessment
Bypassing checksum verification allows a malicious Go toolchain to be delivered, potentially leading to arbitrary code execution in the build environment.
Recommendation
Update the Go toolchain to a version containing the fix and avoid using untrusted GOMODPROXY.
Other vulnerabilities in Go toolchain
See all- CVE-2026-42501High
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This affects users using untrusted module proxies or checksum databases.
- CVE-2026-94444High
Previously, a user operating inside a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY could serve an arbitrary module in its place. The trusted ziphash for the bundled golang.org/fips140 module is now unpacked and its entry in GOMODCACHE is constructed so it can be verified by the toolchain.
Original NVD description (English source)
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS