CVE-2026-56865: 
Golang vulnerability analysis and mitigation

CVE-2026-56865 is a cryptographic signature verification bypass vulnerability in the Go toolchain (cmd/go) and the golang.org/x/mod/sumdb/tlog package, classified under CWE-347 (Improper Verification of Cryptographic Signature). A malicious GOPROXY server can forge up to two sumdb transparency log tiles, allowing attacker-controlled module content to bypass the GOSUMDB integrity check and be persisted to a developer's local Go module cache. Affected versions include cmd/go before 1.25.13, 1.26.0–1.26.6, and 1.27.0-rc.0–1.27.0-rc.2, as well as golang.org/x/mod/sumdb/tlog before 0.40.0. The vulnerability was published on August 13, 2026, with a Feedly-estimated severity of HIGH (golang-announce, OSV).

The root cause is that the Go module download client failed to correctly verify sumdb transparency log tiles against their parent tiles, allowing a malicious GOPROXY to serve forged tile data (CWE-347). By forging up to two tiles in the transparency log structure, an attacker-controlled proxy can present a fabricated inclusion proof that satisfies the client's partial verification, causing the GOSUMDB check to pass for a tampered module. This means the malicious module content is written to the local module cache without any detectable inconsistency in the transparency log as seen by the victim. The fix ensures all tiles are correctly verified against their parents before accepting module content (golang-announce, Go Issue, Go CL 814960).

Successful exploitation allows a malicious GOPROXY operator to silently inject attacker-controlled Go module content into a developer's local module cache, bypassing the GOSUMDB transparency log integrity guarantee. This can lead to supply chain compromise: malicious code embedded in a forged module could be compiled into production software, enabling arbitrary code execution in downstream build environments or deployed applications. The attack is particularly dangerous because the forged content cannot be detected by inspecting the transparency log, undermining the core trust model of the Go module ecosystem (golang-announce, OSV).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The attack requires the victim to be using a malicious or compromised GOPROXY server (e.g., via a misconfigured GOPROXY environment variable, a man-in-the-middle position, or a rogue corporate proxy). The EPSS score is reported as 0.0, and the vulnerability does not appear in the CISA KEV catalog (OSV, golang-announce).

1. Set up a malicious GOPROXY: The attacker operates or compromises a Go module proxy server that the victim's Go toolchain is configured to use (via the GOPROXY environment variable).
2. Identify target module: The attacker selects a Go module the victim is expected to download (e.g., a popular dependency).
3. Forge sumdb tiles: The malicious proxy crafts up to two forged transparency log tiles that appear to validate the tampered module's hash, exploiting the incomplete parent-tile verification in vulnerable Go versions.
4. Serve malicious module content: When the victim's go command fetches the module, the proxy serves the attacker-controlled module archive alongside the forged tiles.
5. Bypass GOSUMDB check: The vulnerable Go client accepts the forged tiles as valid, passes the GOSUMDB integrity check, and writes the malicious module content to the local cache ($GOPATH/pkg/mod).
6. Achieve code execution: The malicious module is subsequently compiled into the victim's project, executing attacker-controlled code in the build environment or resulting binary (golang-announce, Go Issue).

• File System: Unexpected or modified module content in $GOPATH/pkg/mod or the local module cache; go.sum entries that do not match the official sum database for known modules.
• Logs: Go build or go mod tidy output showing modules fetched from an unexpected or untrusted GOPROXY address.
• Environment: GOPROXY environment variable set to an untrusted or unknown proxy URL; GONOSUMCHECK or GONOSUMDB set in ways that further bypass verification.
• Detection Command: Run rm -r go.sum go.work.sum vendor/ && go mod tidy and compare resulting checksums against a trusted environment to identify discrepancies (golang-announce).

Upgrade to a fixed version of the Go toolchain: cmd/go 1.25.13, 1.26.6, or 1.27.0-rc.3 (or later). Users of the golang.org/x/mod library should upgrade to version 0.40.0 or later. To check if your project has been affected by a malicious proxy, run rm -r go.sum go.work.sum vendor/ && go mod tidy and verify the resulting checksums against a trusted source. Additionally, ensure GOPROXY is set to a trusted proxy (e.g., https://proxy.golang.org) and avoid disabling GOSUMDB checks (golang-announce, OSV).

The Go security team disclosed the vulnerability via the official golang-announce mailing list and published a fix simultaneously with the advisory. The issue was also reported to the oss-security mailing list, indicating standard coordinated disclosure practices. No notable independent researcher commentary or significant social media discussion has been identified beyond the official channels as of the disclosure date (golang-announce, oss-sec).