CVE-2026-56864: 
Go vulnerability analysis and mitigation

CVE-2026-56864 is a cryptographic signature verification bypass vulnerability in the Go toolchain's module checksum database (GOSUMDB) client. A malicious GOSUMDB, potentially coordinating with a rogue GOPROXY, can serve arbitrary module content that is not recorded in the transparency log, making the attack undetectable through normal log inspection. Affected software includes Go toolchain cmd/go versions before 1.25.13, 1.26.0–1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb versions before 0.40.0. The vulnerability was published on August 13, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Go Announce).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). The Go module system relies on GOSUMDB to verify that downloaded modules match entries in a public transparency log; however, a flaw in the client-side verification logic allows a malicious GOSUMDB to present module content that bypasses this check, meaning the served content is never validated against the transparency log. Exploitation requires a network-positioned attacker controlling both a GOPROXY and a GOSUMDB endpoint that a victim Go client is configured to trust — no user interaction or authentication is required. Relevant code changes are available in the Go repository (Go Commit, Go Issue, Go Vuln DB).

Successful exploitation allows an attacker to deliver tampered or malicious Go module content to developers or CI/CD pipelines without detection via the transparency log, resulting in a high confidentiality impact (supply chain compromise). Malicious modules could contain backdoors, credential stealers, or other malware that execute within the context of built applications, potentially enabling lateral movement across development and production environments. Integrity and availability are not directly impacted by the vulnerability itself, but downstream effects of malicious module injection can be severe (Feedly, Go Vuln DB).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable with partial technical impact. The EPSS score is approximately 0.118%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, OSV).

1. Set up malicious infrastructure: The attacker operates or compromises a GOPROXY and a GOSUMDB server that a target Go developer or CI/CD system is configured to use (e.g., via environment variables GOPROXY and GOSUMDB).
2. Serve tampered module content: When the victim's Go toolchain requests a module, the malicious GOPROXY serves a modified version of the module containing malicious code.
3. Bypass transparency log verification: The malicious GOSUMDB responds to the client's checksum verification request with a crafted response that satisfies the client's (flawed) verification logic without the module hash actually appearing in the public transparency log.
4. Module accepted by client: The Go toolchain accepts the tampered module as legitimate, writing the attacker-controlled hash to go.sum or go.work.sum.
5. Malicious code execution: The compromised module is compiled into the target application, executing attacker-controlled code during build or at runtime.
6. Detection check: Victims can check for compromise by running rm -r go.sum go.work.sum vendor/ && go mod tidy against a trusted GOPROXY/GOSUMDB to regenerate checksums and compare (Go Announce, Go Issue).

• File System: Unexpected or modified entries in go.sum or go.work.sum that do not match hashes from the official sum.golang.org transparency log; presence of unfamiliar module versions in the vendor/ directory.
• Network: Go toolchain making checksum database requests to non-standard GOSUMDB endpoints (i.e., not sum.golang.org); DNS queries or HTTP requests to unknown GOPROXY or GOSUMDB hosts.
• Logs: Build logs showing module downloads from unexpected proxy URLs; discrepancies between locally cached module hashes and those returned by go mod verify after re-running against a trusted GOSUMDB.
• Process: Unexpected outbound network connections or unusual process behavior originating from applications built with Go modules fetched during the affected period (Go Announce, Go Vuln DB).

Upgrade the Go toolchain to version 1.25.13 or later (for the 1.25.x branch), 1.26.6 or later (for the 1.26.x branch), or 1.27.0-rc.3 or later. The golang.org/x/mod/sumdb package should be updated to version 0.40.0 or later. To check for prior compromise, delete go.sum, go.work.sum, and the vendor/ directory, then run go mod tidy against a trusted GOPROXY and GOSUMDB. Ensure GOPROXY and GOSUMDB environment variables point only to trusted, official endpoints (Go Announce, SUSE Advisory).

The Go team disclosed the vulnerability via the golang-announce mailing list and the OSS-Security list, providing remediation guidance and a detection command (Go Announce, OSS-Sec). Linux distribution vendors including SUSE and openSUSE issued security advisories and updated packages promptly after disclosure (SUSE Advisory, openSUSE). Security scanning vendors Tenable (Nessus) and Qualys added detection plugins shortly after the CVE was published.