Read the docs
TI-2026-69834 Aliases CVE-2026-94444GHSA-2f4j-3hgj-v9j7

Checksum bypass in Go cmd/go lets attackers substitute a module

Priority LOW 35CWE-354Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 14 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

The Go toolchain cmd/go is affected before 1.26.9 and from 1.27.0-0 before 1.27.2. Improper validation of an integrity check value (CWE-354) lets a malicious module proxy serve an arbitrary module in place of the bundled golang.org/fips140 module. A local user with no privileges can be affected when they work inside a malicious Go project and choose to connect to a malicious module proxy.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00097 0th percentileScored 2026-11-07
Fix Partial cmd/go (Go toolchain): 1.26.9, 1.27.2Red Hat: 12 advisoriesRed Hat: 14 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycmd/gobefore 1.26.9; 1.27.0-0 to before 1.27.21.26.9, 1.27.2Patch availableCNA
  • cmd/go VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*——Go standard library

Remediation

Upgrade cmd/go to 1.26.9 or 1.27.2. Red Hat advisories that fix it include RHSA-2026:90994, RHSA-2026:87245, RHSA-2026:87246, RHSA-2026:87043, RHSA-2026:87042, RHSA-2026:87041, RHSA-2026:87040, RHSA-2026:86196, RHSA-2026:86203, RHSA-2026:86093, RHSA-2026:79720 and RHSA-2026:79715. The sources list no fixed version for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Migration Toolkit for Applications 8 and Exploit Intelligence.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA cmd/go (Go toolchain) Fixed in 1.26.9, 1.27.2

Red Hat 12 advisories

  • RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
Show 9 more Red Hat advisories
  • RHSA-2026:87043 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.26.10-1.el9_6, golang-1.26.10-1.el9_6, golang-bin-1.26.10-1.el9_6 +5
  • RHSA-2026:87042 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) go-toolset-1.26.10-1.el9_4, golang-1.26.10-1.el9_4, golang-bin-1.26.10-1.el9_4 +5
  • RHSA-2026:87041 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) go-toolset-1.26.10-1.el9_2, golang-1.26.10-1.el9_2, golang-bin-1.26.10-1.el9_2 +5
  • RHSA-2026:87040 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.26.10-1.el10_0, golang-1.26.10-1.el10_0, golang-bin-1.26.10-1.el10_0 +5
  • RHSA-2026:86196 Released 2026-10-20 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.26.10-1.el9_8, golang-1.26.10-1.el9_8, golang-bin-1.26.10-1.el9_8 +5
  • RHSA-2026:86203 Released 2026-10-20 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.26.1-1.module+el8.10.0+24516+40554724.aarch64::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.src::go-toolset:rhel8 +22
  • RHSA-2026:86093 Released 2026-10-20 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.10-1.el10_2, golang-1.26.10-1.el10_2, golang-bin-1.26.10-1.el10_2 +5
  • RHSA-2026:79720 Released 2026-10-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.26-1.26.9-0.1.hum1@aarch64, golang1.26-1.26.9-0.1.hum1@src, golang1.26-1.26.9-0.1.hum1@x86_64 +14
  • RHSA-2026:79715 Released 2026-10-08 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.27-1.27.2-0.1.hum1@aarch64, golang1.27-1.27.2-0.1.hum1@src, golang1.27-1.27.2-0.1.hum1@x86_64 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Go toolchain cmd/go 1.26.9, 1.27.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-69835 Checksum verification bypass for golang.org/toolchain in Go cmd/goPriority LOW 35
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Out of support scope
Migration Toolkit for Applications 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86093
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86203
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86196
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:90994
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:87246
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:87245
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:87041
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:87042
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:87040
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:87043
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:90994
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:87246
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:87245
Red Hat Hardened ImagesFixed RHSA-2026:79715, RHSA-2026:79720

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-94444
  2. 2026-10-10 Affected versions changed · Red Hat
  3. 2026-10-10 Fix available: RHSA-2026:79720 · Red Hat
  4. 2026-10-16 Alias added: GHSA-2f4j-3hgj-v9j7
  5. 2026-10-16 CVSS score added · CISA ADP
  6. 2026-10-16 Weakness changed · CISA ADP
  7. 2026-10-16 CISA SSVC decision points changed
  8. 2026-10-23 Fix available: RHSA-2026:87246 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:86093 · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:86196 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:86203 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:87042 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:87040 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:87041 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:87043 · Red Hat
  16. 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +6 · Red Hat
  17. 2026-10-24 Fix available: RHSA-2026:87245 · Red Hat
  18. 2026-10-24 Fix available: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · Red Hat
  19. 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
  20. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat

References

Other 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences