CVE-2026-94447: 
Go Análise e mitigação de vulnerabilidades

CVE-2026-94447 is a checksum verification bypass vulnerability in the Go toolchain's cmd/go component, classified as a tampering vulnerability (CWE-354: Improper Validation of Integrity Check Value). A local user operating inside a malicious Go project that defines a bogus golang.org/toolchain entry in go.sum and uses a malicious GOMODPROXY can bypass the intended checksum verification mechanism. Affected versions include Go cmd/go before 1.26.9 and 1.27.0-0 through before 1.27.2. The vulnerability was published on October 8, 2026, with patches released the same day. It carries a medium severity rating with a CVSS score reflecting local access requirements and high impact on confidentiality, integrity, and availability (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of integrity check values (CWE-354), specifically in how cmd/go handled golang.org/toolchain checksums. Prior to the fix, the Go toolchain would accept a golang.org/toolchain checksum from the local go.sum file even if that entry was maliciously crafted, rather than always fetching the canonical checksum from the network. An attacker must supply a malicious Go project with a poisoned go.sum file and control the GOMODPROXY environment variable to serve a tampered toolchain. The fix enforces that golang.org/toolchain always retrieves its checksum directly from the network, preventing local go.sum manipulation from overriding legitimate checksums. The attack is mapped to CAPEC-145 (Checksum Spoofing) and CAPEC-75 (Manipulating Writeable Configuration Files) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker with write access to a Go project's go.sum file and control over the GOMODPROXY environment to serve a malicious Go toolchain version, potentially achieving arbitrary code execution in the context of the user running the Go toolchain. This results in high confidentiality, integrity, and availability impact — attacker-controlled modules can alter build integrity, execute arbitrary code, and disrupt the build or user environment. The scope is limited to the same security authority as the user running go, with no scope change beyond that user context (Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires multiple preconditions: the victim must operate inside a malicious Go project, the attacker must have poisoned the go.sum file, and the victim must use an attacker-controlled GOMODPROXY — making opportunistic exploitation unlikely (GitHub Advisory, Red Hat Bugzilla).

1. Prepare malicious project: The attacker creates or compromises a Go project repository and inserts a crafted golang.org/toolchain entry with a bogus checksum into the project's go.sum file.
2. Set up malicious proxy: The attacker operates a malicious GOMODPROXY server that serves a tampered Go toolchain binary corresponding to the bogus checksum in go.sum.
3. Social engineering: The attacker convinces a developer or CI/CD system to clone/open the malicious project and configure GOMODPROXY to point to the attacker-controlled proxy (e.g., via a .env file, project documentation, or a compromised dependency).
4. Trigger toolchain download: The victim runs a go command (e.g., go build, go mod tidy) inside the malicious project, causing cmd/go to look up the golang.org/toolchain entry.
5. Checksum bypass: On vulnerable versions, cmd/go accepts the bogus checksum from the local go.sum rather than fetching the canonical checksum from the network, and downloads the malicious toolchain from the attacker's proxy.
6. Arbitrary code execution: The malicious toolchain binary is executed in the context of the victim user, enabling arbitrary code execution, data exfiltration, or further compromise of the build environment (Red Hat Bugzilla, GitHub Advisory).

• File System: Unexpected or modified golang.org/toolchain entries in a project's go.sum file with checksums that do not match the official Go checksum database; presence of unfamiliar toolchain binaries in the Go module cache ($GOPATH/pkg/mod/golang.org/toolchain@*).
• Network: Outbound connections from developer workstations or CI/CD systems to unexpected or unknown GOMODPROXY servers during go command execution; absence of expected connections to sum.golang.org for toolchain checksum verification.
• Logs: Build logs showing toolchain downloads from non-standard proxy URLs; errors or anomalies in Go module verification logs related to golang.org/toolchain.
• Process: Unexpected child processes spawned by the Go toolchain binary (e.g., shells, network utilities) during or after a go build or go mod operation.

Upgrade Go to version 1.26.9 or later (for the 1.26.x series) or 1.27.2 or later (for the 1.27.x series), which enforce that golang.org/toolchain always fetches the canonical checksum from the network rather than trusting the local go.sum file. As interim workarounds: restrict write access to go.sum files in shared or CI/CD environments; configure GOMODPROXY to use only trusted, official proxy servers (e.g., proxy.golang.org); and avoid running Go commands inside untrusted or unverified project directories. Red Hat has issued advisories (RHSA-2026:79715, RHSA-2026:79720) for affected Red Hat products (GitHub Advisory, Red Hat Bugzilla).

The Go security team announced the fix via the golang-announce mailing list, and the issue was tracked publicly at go.dev/issue/81834. Red Hat filed a Bugzilla entry and issued errata (RHSA-2026:79715 and RHSA-2026:79720) for affected products, indicating broad downstream impact across enterprise Linux distributions. The vulnerability was also reported to the OSS-Security mailing list shortly after disclosure (Red Hat Bugzilla, GitHub Advisory).