CVE-2026-94444: 
Go vulnerability analysis and mitigation

CVE-2026-94444 is a module substitution vulnerability in the Go toolchain's cmd/go component that allows a local attacker to replace the legitimate golang.org/fips140 module with an arbitrary malicious module via an untrusted GOMODPROXY. The flaw affects Go toolchain versions before 1.26.9 and versions 1.27.0-0 through 1.27.2. It was published on October 8, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of integrity check values (CWE-354): the Go toolchain previously did not verify the trusted ziphash for the bundled golang.org/fips140 module when constructing its entry in the GOMODCACHE, allowing a malicious module to be served in its place. An attacker must craft a Go project that defines a bogus golang.org/fips140 module and operate a malicious GOMODPROXY that the victim developer connects to. The victim must open and operate within the malicious project, making user interaction a required precondition. The fix unpacks the trusted ziphash for the bundled golang.org/fips140 module and constructs its GOMODCACHE entry so the toolchain can verify it (GitHub Advisory, Go Issue).

Successful exploitation allows an attacker to inject arbitrary code into the Go build process by substituting the legitimate golang.org/fips140 module with a malicious one, resulting in high confidentiality, integrity, and availability impact within the user's security context. This can compromise build artifacts, expose sensitive data accessible to the build user, and disrupt or terminate the build environment. The scope is unchanged, meaning impact is confined to the user running the Go toolchain, but malicious build outputs could propagate downstream to any software produced by the affected build system (Red Hat Bugzilla, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.115%, placing it in the 1st percentile for exploitation likelihood within 30 days. Exploitation is not automatable, as it requires the victim to actively open a malicious Go project and configure a malicious GOMODPROXY (GitHub Advisory, Red Hat Bugzilla).

1. Prepare malicious Go project: Create a Go project that defines a bogus golang.org/fips140 module in its go.mod file, overriding the legitimate bundled module.
2. Set up malicious GOMODPROXY: Operate a rogue module proxy server that serves the attacker-controlled golang.org/fips140 module (containing arbitrary malicious code) in response to module download requests.
3. Social engineer the victim: Distribute the malicious Go project to a target developer (e.g., via a public repository, supply chain compromise, or phishing), and instruct or trick them into configuring their GOMODPROXY environment variable to point to the attacker's proxy.
4. Victim opens the project: The victim developer opens and operates within the malicious Go project, triggering the Go toolchain to fetch golang.org/fips140 from the attacker's proxy without verifying the ziphash.
5. Arbitrary code execution: The malicious module is installed into the victim's GOMODCACHE and executed during the build process, allowing the attacker to run arbitrary code in the context of the developer's account (GitHub Advisory, Red Hat Bugzilla).

• Network: Outbound HTTP/HTTPS connections from developer workstations to unexpected or unknown GOMODPROXY endpoints during Go builds; DNS queries for unfamiliar module proxy domains.
• File System: Presence of unexpected or modified golang.org/fips140 module files in the GOMODCACHE directory (typically $GOPATH/pkg/mod/cache); ziphash mismatch or missing hash entries for golang.org/fips140 in the module cache.
• Logs: Go toolchain build logs showing golang.org/fips140 being fetched from a non-standard or untrusted proxy URL; errors or warnings related to module verification failures in Go build output.
• Process: Unexpected child processes spawned during go build or go mod download operations; unusual network activity initiated by the Go toolchain process.

Upgrade the Go toolchain to version 1.26.9 or later (for the 1.26.x series) or version 1.27.2 or later (for the 1.27.x series), which fix the ziphash verification for the bundled golang.org/fips140 module (GitHub Advisory). As a configuration-based workaround, ensure GOMODPROXY is set only to trusted module repositories (e.g., https://proxy.golang.org) and avoid operating within untrusted or third-party Go projects that may define bogus golang.org/fips140 modules. Red Hat has also issued advisories (RHSA-2026:79715, RHSA-2026:79720) for affected Red Hat products (Red Hat Bugzilla).

The vulnerability was announced via the official golang-announce mailing list and tracked as GO-2026-6601 in the Go vulnerability database. Red Hat, SUSE, Mageia, and AusCERT all issued advisories or bulletins addressing the flaw in their respective Go packages. Microsoft also published a security advisory for the CVE. Community discussion has been limited given the low EPSS score and absence of public exploits.