Read the docs
TI-2026-41000 Aliases CVE-2026-56864

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Priority LOW 39CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-347.

Summary

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Partial cmd/go (Go toolchain): 1.25.13, 1.26.6, 1.27.0-rc.3golang.org/x/mod/sumdb (golang.org/x/mod): 0.40.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycmd/gobefore 1.25.13; 1.26.0-0 to before 1.26.6; 1.27.0-0 to before 1.27.0-rc.31.25.13, 1.26.6, 1.27.0-rc.3Patch availableCNA
golang.org/x/modgolang.org/x/mod/sumdbbefore 0.40.00.40.0Patch availableCNA
  • cmd/go VendorGo standard library Affected before 1.25.13; 1.26.0-0 to before 1.26.6; 1.27.0-0 to before 1.27.0-rc.3 Fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 Patch available CNA
  • golang.org/x/mod/sumdb Vendorgolang.org/x/mod Affected before 0.40.0 Fixed in 0.40.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*——Go standard library

Remediation

  • Fix · CNA cmd/go (Go toolchain) Fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
  • Fix · CNA golang.org/x/mod/sumdb (golang.org/x/mod) Fixed in 0.40.0

Red Hat 2 advisories

  • RHSA-2026:74609 Released 2026-10-01 · Red Hat rating Important
    Cluster Observability Operator 1.5.3
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +13
  • RHSA-2026:67714 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.11.4 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Go toolchain cmd/go 1.25.13, 1.26.6, 1.27.0-rc.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-41001 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogPriority LOW 37
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift PipelinesAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:74609
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:67714
Not affected: 5 products
  • Cluster Observability Operator 1.5
  • ExternalDNS Operator
  • Multicluster Engine for Kubernetes
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat OpenShift distributed tracing 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56864
  2. 2026-10-06 Affected versions changed · Red Hat
  3. 2026-10-23 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  4. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  5. 2026-11-06 Fix available: Cluster Observability Operator 1.5 · Red Hat
  6. 2026-11-06 Affected versions changed · Red Hat

References

Other 5

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences