CVE-2026-56865: 
Go vulnerability analysis and mitigation

CVE-2026-56865 is a cryptographic signature verification bypass vulnerability in the Go toolchain's module proxy (cmd/go) and the golang.org/x/mod/sumdb/tlog package. A malicious GOPROXY can forge up to two sumdb (GOSUMDB) transparency log tiles, allowing attacker-controlled module content to be persisted to a developer's local Go module cache without detection. Affected versions include cmd/go before 1.25.13, 1.26.0–1.26.6, and 1.27.0-0–1.27.0-rc.3, as well as golang.org/x/mod/sumdb/tlog before 0.40.0. It carries a CVSS v3.1 base score of 8.4 (High) (Feedly, Go Advisory).

The root cause is improper verification of cryptographic signatures (CWE-347): the Go toolchain failed to correctly verify sumdb tiles against their parent tiles in the transparency log, allowing a malicious GOPROXY to forge up to two tiles and serve them as legitimate. An attacker controlling a GOPROXY endpoint can craft forged tile responses that pass the incomplete verification checks, causing the go command to accept and cache malicious module content as if it were verified by GOSUMDB. The attack vector is local (the developer's build environment must be configured to use the malicious proxy), requires no privileges, and no user interaction. Fixes were applied in Go CLs 814960 and 815020, which enforce correct parent-tile verification for all tiles (Go Issue, Go Advisory).

A successful attack allows an adversary controlling a GOPROXY to inject malicious code into a developer's local Go module cache during routine dependency management operations (e.g., go mod tidy, go get). Because the forged tiles bypass GOSUMDB transparency log verification, the malicious module content cannot be detected by standard integrity checks, meaning developers and CI/CD pipelines may unknowingly build and ship applications containing attacker-controlled code. This creates high confidentiality, integrity, and availability risk across any software supply chain relying on the compromised Go modules (Feedly, Go Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.123%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control or compromise a GOPROXY server that a target developer or build system is configured to use, limiting the attack surface to supply chain scenarios (Go Advisory, OSV).

1. Set up a malicious GOPROXY: The attacker deploys a rogue Go module proxy server and positions it as the GOPROXY for a target developer or CI/CD environment (e.g., via network interception, DNS poisoning, or social engineering to change GOPROXY environment variable).
2. Identify a target module: The attacker selects a Go module that the victim project depends on and prepares a malicious version with backdoored or weaponized code.
3. Forge sumdb tiles: Exploiting the incomplete tile verification logic, the attacker crafts up to two forged sumdb transparency log tiles that appear valid to the vulnerable Go toolchain, bypassing the GOSUMDB integrity check.
4. Serve malicious module content: When the victim runs go mod tidy, go get, or a similar command, the rogue proxy serves the malicious module alongside the forged tiles; the Go toolchain accepts and caches the content without detecting the forgery.
5. Achieve code execution: The malicious module is incorporated into the victim's build, resulting in attacker-controlled code being compiled into and shipped with the target application (Go Issue, Go Advisory).

• Network: Unexpected or unauthorized GOPROXY endpoints in environment variables (GOPROXY) or Go configuration; outbound connections to unfamiliar proxy servers during go mod operations.
• File System: Presence of unexpected or modified entries in the local Go module cache ($GOPATH/pkg/mod/cache); go.sum or go.work.sum files containing hashes that do not match known-good values from the official sum database.
• Logs: Build or CI/CD logs showing module downloads from non-standard or unexpected proxy URLs; errors or anomalies in sumdb tile verification during go mod commands.
• Process: Unusual behavior or network activity from applications built with recently fetched Go modules; unexpected changes in compiled binary behavior after dependency updates.

To check for compromise, run: rm -r go.sum go.work.sum vendor/ && go mod tidy and verify that all module hashes resolve correctly against the official GOSUMDB (Feedly, Go Advisory).

Update the Go toolchain to a patched version: cmd/go 1.25.13 or later, 1.26.6 or later, or 1.27.0-rc.3 or later; update golang.org/x/mod to version 0.40.0 or later. To check for and remediate potential compromise, remove cached module data and re-verify dependencies: rm -r go.sum go.work.sum vendor/ && go mod tidy. Additionally, ensure GOPROXY and GONOSUMCHECK environment variables are set to trusted values, and avoid using untrusted or third-party proxy servers (Go Advisory, golang-announce).

The Go team disclosed the vulnerability via the golang-announce mailing list and published a detailed advisory on the Go vulnerability database. SUSE issued multiple security updates (SUSE-SU-2026:3640-1, SUSE-SU-2026:3799-1, SUSE-SU-2026:3815-1, SUSE-SU-2026:3830-1) addressing the issue in their Go packages. OpenSUSE and Yocto Project security lists also published advisories. Tenable and Qualys added detection plugins for the vulnerability. The issue was also discussed on the oss-security mailing list (golang-announce, SUSE Advisory, oss-sec).