CVE-2026-56865: 
cAdvisor Análisis y mitigación de vulnerabilidades

CVE-2026-56865 is a cryptographic signature verification bypass vulnerability in the Go toolchain's module proxy system, classified under CWE-347 (Improper Verification of Cryptographic Signature). A malicious GOPROXY can forge up to two sumdb (GOSUMDB) transparency log tiles, allowing attacker-controlled module content to bypass integrity checks and persist in a developer's local Go module cache without detection. The vulnerability affects cmd/go versions before 1.25.13, 1.26.0–1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb/tlog versions before 0.40.0. It was published on August 13, 2026, and carries a CVSS v3.1 base score of 8.4 (High) (Golang Announce, OSV).

The root cause is improper verification of sumdb transparency log tiles (CWE-347): the Go toolchain failed to correctly verify fetched tiles against their parent tiles in the Merkle tree structure used by GOSUMDB. A malicious GOPROXY could forge up to two sumdb tiles, which was sufficient to serve a crafted module that passes the (incomplete) tile verification and gets written to the local module cache. Because the forged tiles are not detectable by evaluating the transparency log in its compromised state, the attack is silent during normal go get or go mod tidy operations. The fix ensures all tiles are correctly verified against their parents before any module content is accepted (Golang Issue, Go CL 814960, Go CL 815020).

Successful exploitation allows an attacker controlling a GOPROXY to inject arbitrary, attacker-controlled Go module code into a developer's local module cache, which is then compiled into applications without any transparency log warning. This represents a full supply chain compromise: confidentiality, integrity, and availability are all rated High, as malicious code could exfiltrate secrets, backdoor binaries, or cause denial of service in downstream applications. The attack targets the software build pipeline, meaning any application built using a compromised module could be affected, with potential for broad lateral impact across development and CI/CD environments (OSV, Golang Announce).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.00123, reflecting low near-term exploitation probability. The attack is not automatable (per NVD SSVC assessment) and requires the attacker to control or compromise a GOPROXY server that the victim developer is configured to use. The vulnerability is not listed in the CISA KEV catalog (OSV, Golang Announce).

1. Set up a malicious GOPROXY: The attacker operates or compromises a Go module proxy server that a target developer or CI/CD pipeline is configured to use (via the GOPROXY environment variable).
2. Intercept a module request: When the victim runs go get, go mod tidy, or a similar command, the malicious proxy intercepts the request for a specific module version.
3. Forge sumdb tiles: The attacker crafts up to two forged sumdb transparency log tiles that appear valid to the (pre-patch) Go toolchain's incomplete tile verification logic, bypassing the GOSUMDB integrity check.
4. Serve malicious module content: The proxy serves attacker-controlled module source code alongside the forged tiles, causing the Go toolchain to accept and cache the malicious module locally.
5. Persist in module cache: The malicious module is written to the developer's local Go module cache ($GOPATH/pkg/mod) and recorded in go.sum, where it will be used in subsequent builds without re-verification.
6. Code execution at build time: Any application that imports the compromised module will compile and execute the attacker's code, enabling backdoors, data exfiltration, or other malicious behavior (Golang Issue, OSV).

• File System: Unexpected or modified entries in go.sum or go.work.sum for modules fetched via an untrusted GOPROXY; module directories in $GOPATH/pkg/mod with unexpected content or checksums.
• Logs: Go toolchain output showing modules fetched from an unusual or untrusted GOPROXY endpoint; absence of GOSUMDB verification errors despite using a non-standard proxy.
• Configuration: GOPROXY environment variable set to an untrusted or unknown server; GONOSUMCHECK or GONOSUMDB set in ways that further bypass verification.
• Detection command: Run rm -r go.sum go.work.sum vendor/ && go mod tidy and compare the regenerated go.sum against the previous version — discrepancies indicate potential tampering (Golang Announce, OSV).

Update the Go toolchain to a patched version: 1.25.13, 1.26.6, or 1.27.0-rc.3 or later; update golang.org/x/mod to 0.40.0 or later. To check if you have been affected, run rm -r go.sum go.work.sum vendor/ && go mod tidy and verify the regenerated checksums. Additionally, ensure GOPROXY is set only to trusted proxy servers, and consider using GONOSUMCHECK and GOFLAGS settings to enforce direct or verified proxy usage in sensitive environments (Golang Announce, Go CL 814960, SUSE Advisory).

The Go team disclosed the vulnerability via the golang-announce mailing list and published a detailed issue and code review. The OpenSUSE and SUSE security teams issued advisories and package updates shortly after disclosure. The Yocto Project security list also flagged the issue for embedded Linux developers using Go. Coverage has been largely technical and vendor-driven, with no notable controversy or widespread social media discussion observed (Golang Announce, SUSE Advisory, OpenSUSE).