Bug 2548342 (CVE-2026-94447)

Summary: CVE-2026-94447 cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, cahl, crizzo, dfreiber, dpaolell, drow, jburrell, jdelft, jupierce, kaycoth, lgarciaa, ljawale, mbiarnes, msilmser, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rjohnson, sdawley, sghai, sidsharm, suppawar, vkumar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be downloaded and executed.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2548365    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-08 23:01:43 UTC 
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Comment 2 Yadnyawalk Tale 2026-10-09 05:25:42 UTC 
CVSS Justification
===================
AV:L -- Exploitation requires running the local go command on the victim host.
AC:H -- Attacker must supply a malicious Go project and the user must also use an untrusted module proxy.
PR:L -- A local account (developer/build user) is required to invoke the go toolchain; an unauthenticated remote party cannot trigger the flaw on its own.
UI:R -- The user must open/operate inside the malicious project (and choose that proxy).
S:U -- Impact stays in the same security authority as the user running go.
C:H -- Successful exploitation can execute attacker-controlled code in that user context.
I:H -- Attacker-controlled modules/toolchain can alter build integrity.
A:H -- Arbitrary code execution can disrupt or terminate the build/user environment.