Bug 2548343 (CVE-2026-94444)

Summary: CVE-2026-94444 cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, cahl, crizzo, dfreiber, dpaolell, drow, jburrell, jdelft, jupierce, kaycoth, lgarciaa, ljawale, mbiarnes, msilmser, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rjohnson, sdawley, sghai, sidsharm, suppawar, vkumar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy (GOMODPROXY), the proxy can serve an arbitrary replacement module that still passes local verification. This can lead to arbitrary code execution during Go build or module download operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2548366    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-08 23:01:46 UTC 
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Comment 2 Yadnyawalk Tale 2026-10-09 05:25:34 UTC 
CVSS Justification
===================
AV:L -- Exploitation requires running the local go command on the victim host.
AC:H -- Attacker must supply a malicious Go project and the user must also use an untrusted module proxy.
PR:L -- A local account (developer/build user) is required to invoke the go toolchain; an unauthenticated remote party cannot trigger the flaw on its own.
UI:R -- The user must open/operate inside the malicious project (and choose that proxy).
S:U -- Impact stays in the same security authority as the user running go.
C:H -- Successful exploitation can execute attacker-controlled code in that user context.
I:H -- Attacker-controlled modules/toolchain can alter build integrity.
A:H -- Arbitrary code execution can disrupt or terminate the build/user environment.