TI-2026-41001 Aliases CVE-2026-56865

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

LOW 37CWE-347Published 2026-08-13 · Updated 2026-08-14

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-347.

Summary

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00129 2nd percentileScored 2026-11-07

Fix Partial cmd/go (Go toolchain): 1.25.13, 1.26.6, 1.27.0-rc.3golang.org/x/mod/sumdb/tlog (golang.org/x/mod): 0.40.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Go standard library	cmd/go	before 1.25.13; 1.26.0-0 to before 1.26.6; 1.27.0-0 to before 1.27.0-rc.3	1.25.13, 1.26.6, 1.27.0-rc.3	Patch available	CNA
golang.org/x/mod	golang.org/x/mod/sumdb/tlog	before 0.40.0	0.40.0	Patch available	CNA

cmd/go VendorGo standard library Affected before 1.25.13; 1.26.0-0 to before 1.26.6; 1.27.0-0 to before 1.27.0-rc.3 Fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 Patch available CNA
golang.org/x/mod/sumdb/tlog Vendorgolang.org/x/mod Affected before 0.40.0 Fixed in 0.40.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:golang:go::::::::	—	—	Go standard library

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions — — ·Go standard library

Remediation

Fix · CNA cmd/go (Go toolchain) Fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
Fix · CNA golang.org/x/mod/sumdb/tlog (golang.org/x/mod) Fixed in 0.40.0

Red Hat 2 advisories

RHSA-2026:74609 Released 2026-10-01 · Red Hat rating Important
Cluster Observability Operator 1.5.3
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +13
RHSA-2026:67714 Released 2026-09-15 · Red Hat rating Important
RHACS 4.11.4 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-13
Go toolchain cmd/go 1.25.13, 1.26.6, 1.27.0-rc.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-41000 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbPriority LOW 39
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
ExternalDNS Operator	Affected	No fix yet
Multicluster Engine for Kubernetes	Affected	No fix yet
OpenShift Pipelines	Affected	No fix yet
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet
Red Hat OpenShift distributed tracing 3	Affected	No fix yet
Cluster Observability Operator 1.5	Fixed	RHSA-2026:74609
Red Hat Advanced Cluster Security for Kubernetes 4.11	Fixed	RHSA-2026:67714

Not affected: 4 products

Cluster Observability Operator 1.5
Red Hat Advanced Cluster Security for Kubernetes 4.11
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Timeline

2026-10-02 Threatist record created from CVE-2026-56865
2026-10-06 Affected versions changed · Red Hat
2026-10-29 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
2026-11-06 Affected versions changed · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

Other 5

TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5

See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences