CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/814960
https://go.dev/cl/815020
https://go.dev/issue/80744
https://groups.google.com/g/golang-announce/c/94pEornpRlI
https://pkg.go.dev/vuln/GO-2026-6179

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-13 22:17

Updated : 2026-09-03 16:37

NVD link : CVE-2026-56865

Mitre link : CVE-2026-56865

CVE.ORG link : CVE-2026-56865

JSON object : View

Products Affected

No product.

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-56865", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56865", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T15:33:28.143873Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go toolchain", "product": "cmd/go", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.13", "versionType": "semver"}, {"status": "affected", "version": "1.26.0-0", "lessThan": "1.26.6", "versionType": "semver"}, {"status": "affected", "version": "1.27.0-0", "lessThan": "1.27.0-rc.3", "versionType": "semver"}], "packageName": "cmd/go", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected"}, {"vendor": "golang.org/x/mod", "product": "golang.org/x/mod/sumdb/tlog", "versions": [{"status": "affected", "version": "0", "lessThan": "0.40.0", "versionType": "semver"}], "packageName": "golang.org/x/mod/sumdb/tlog", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "tileHashReader.ReadHashes"}]}]}], "published": "2026-08-13T22:17:22.797", "references": [{"url": "https://go.dev/cl/814960", "source": "security@golang.org"}, {"url": "https://go.dev/cl/815020", "source": "security@golang.org"}, {"url": "https://go.dev/issue/80744", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6179", "source": "security@golang.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy"}], "lastModified": "2026-09-03T16:37:52.170", "sourceIdentifier": "security@golang.org"}