CVE-2026-94444: Checksum Bypass in Go Toolchain's cmd/go Package
Summary
CVE-2026-94444: Checksum bypass for golang.org/fips140 in cmd/go. Affects toolchain across 2 version ranges.
< 1.26.9
>= 1.27.0-0, < 1.27.2
Fixed in 1.26.9 or 1.27.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2026-94444 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Go toolchain is a set of tools that facilitate the development of Go applications, including the 'cmd/go' command which is responsible for managing Go modules and dependencies. This toolchain is essential for building, testing, and deploying Go applications. The vulnerability in question affects the integrity of module verification, potentially allowing malicious actors to serve arbitrary modules.
Vulnerability Detail
The vulnerability arises from a checksum bypass in the 'golang.org/fips140' module. A user operating within a malicious Go project can define a bogus version of this module and connect to a malicious GOMODPROXY. This setup allows the malicious proxy to serve arbitrary modules instead of the intended ones, compromising the integrity of the Go module system. The implications are severe, as it can lead to the execution of untrusted code, data breaches, or other security incidents.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.26.91.26.9go get toolchain@v1.26.9 -
>= 1.27.0-0, < 1.27.21.27.2go get toolchain@v1.27.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using untrusted GOMODPROXYs and ensure that they are only connecting to verified sources for module downloads. Additionally, users can manually verify the integrity of modules before use.
Conclusion
CVE-2026-94444 presents a significant risk to users of the Go toolchain, particularly those utilizing the 'cmd/go' package. It is crucial to update to the latest patched versions to mitigate this vulnerability and ensure the integrity of your Go applications.
See every vulnerability recorded for toolchain →
FAQ
CVE-2026-94444 is a vulnerability in the Go toolchain that allows checksum bypass for the 'golang.org/fips140' module, potentially enabling the execution of arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include the execution of untrusted code, data breaches, and potential compromise of the entire application environment.
You can update your Go toolchain by running 'go get golang.org/x/tools@latest' in your terminal to ensure you have the latest patched version.
If immediate updates are not possible, avoid using untrusted GOMODPROXYs and verify the integrity of modules manually.
References
Related vulnerabilities
Recent vulnerabilities recorded for toolchain.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
