CVE-2026-56864: 
cAdvisor Análisis y mitigación de vulnerabilidades

CVE-2026-56864 is a cryptographic signature verification bypass vulnerability in the Go toolchain's module transparency system, classified under CWE-347 (Improper Verification of Cryptographic Signature). A malicious GOSUMDB server can serve arbitrary module content not contained within the transparency log, and when coordinating with a malicious GOPROXY, can deliver tampered Go modules to clients without detection. Affected products include cmd/go (Go toolchain versions before 1.25.13, 1.26.0–1.26.6, and 1.27.0-0–1.27.0-rc.3) and golang.org/x/mod/sumdb versions before 0.40.0. It was published on August 13, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (golang-announce, Go Vuln DB).

The root cause is improper verification of cryptographic signatures (CWE-347) in the Go module sum database (GOSUMDB) client implementation. The Go module system relies on a transparency log to ensure that module content served by a proxy matches what was recorded; however, a malicious GOSUMDB can present valid-looking responses that reference log entries not actually containing the served content, bypassing integrity checks. Exploitation requires a coordinating pair of malicious GOPROXY and GOSUMDB servers — the attacker must be positioned to intercept or redirect Go module fetch requests (e.g., via a rogue proxy or DNS manipulation). The fix was applied in Go commits CL 815000 and CL 815020, and the issue was tracked at go.dev/issue/80745 (Go Vuln DB, OSV).

Successful exploitation allows an attacker to deliver malicious Go module content to developers or build systems without triggering transparency log verification failures, effectively enabling a supply chain attack. The primary impact is high confidentiality risk — malicious modules could exfiltrate secrets, introduce backdoors, or compromise build artifacts — with no direct availability or integrity impact scored at the network level. The attack is automatable and requires no user interaction or privileges, making it particularly dangerous in CI/CD pipelines that automatically fetch Go dependencies (golang-announce, Go Vuln DB).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.118%, indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation status as "none" and the attack as automatable. CVE-2026-56864 does not appear in the CISA Known Exploited Vulnerabilities catalog (golang-announce, OSV).

1. Setup malicious infrastructure: Deploy a rogue GOPROXY and GOSUMDB server pair under attacker control, configured to serve a trojanized version of a target Go module.
2. Redirect victim traffic: Position the malicious proxy/sumdb to intercept Go module fetch requests — via DNS hijacking, BGP manipulation, a compromised corporate proxy, or by convincing a developer/CI system to use a custom GOPROXY/GOSUMDB environment variable.
3. Serve crafted module content: When the victim's go toolchain requests a module, the malicious GOSUMDB returns a response that appears to reference a valid transparency log entry but actually covers different (malicious) content, bypassing the client's log verification.
4. Deliver malicious module: The victim's go mod tidy or go get command downloads and caches the tampered module without detecting the mismatch, as the transparency log check is circumvented.
5. Achieve code execution: The malicious module is compiled into the victim's application or executed in their build pipeline, enabling arbitrary code execution, credential theft, or further supply chain compromise (Go Vuln DB, golang-announce).

• Logs: Unexpected or unfamiliar GOPROXY or GOSUMDB values in build environment logs; go mod tidy or go get operations referencing non-standard proxy/sumdb endpoints.
• File System: Presence of unexpected or modified entries in go.sum or go.work.sum that do not match known-good hashes for a given module version; vendor directory contents differing from expected upstream source.
• Network: Outbound DNS or HTTP requests to unknown or suspicious GOPROXY/GOSUMDB hostnames from developer workstations or CI/CD build agents.
• Process: Build processes fetching modules from non-default proxy endpoints (i.e., not proxy.golang.org or sum.golang.org) without explicit organizational policy (Go Vuln DB).

Detection command (recommended by Go team):

rm -r go.sum go.work.sum vendor/ && go mod tidy

If the regenerated go.sum differs from the committed version, the environment may have been affected.

Upgrade to a fixed version of the Go toolchain: 1.25.13 or later (for the 1.25.x branch), 1.26.6 or later (for the 1.26.x branch), or 1.27.0-rc.3 or later (for pre-release). Users of golang.org/x/mod/sumdb should upgrade to v0.40.0 or later. As a detection step, run rm -r go.sum go.work.sum vendor/ && go mod tidy and compare the regenerated go.sum against the previously committed version to identify any tampering. Additionally, ensure GOPROXY and GOSUMDB environment variables are set to trusted, official endpoints (proxy.golang.org and sum.golang.org) in all build environments (golang-announce, Go Vuln DB).

The Go team disclosed the vulnerability via the golang-announce mailing list and the Go vulnerability database. The issue was also discussed on the oss-security mailing list (oss-sec). Downstream Linux distributions including SUSE and openSUSE issued security advisories and updates (SUSE Advisory, openSUSE). Tailscale's Go fork also incorporated the fix. Community reaction on Mastodon noted the supply chain implications of the vulnerability.