CVE-2026-94444: Go Toolchain Module Substitution Vulnerability

CVE-2026-94444 Overview

CVE-2026-94444 affects the Go toolchain's handling of the bundled golang.org/fips140 module. A malicious Go project can declare a bogus golang.org/fips140 module and, combined with an attacker-controlled GOMODPROXY, substitute arbitrary module contents in place of the trusted FIPS 140 module. The flaw stems from insufficient verification [CWE-354] of module data loaded from the proxy chain. Exploitation requires a developer to operate inside the malicious project and connect to the attacker's proxy, enabling local code execution during build or module resolution.

Critical Impact
An attacker who controls a Go project and GOMODPROXY can substitute the trusted golang.org/fips140 module with arbitrary code, leading to compromise of the developer workstation.

Affected Products

Go toolchain versions that bundle the golang.org/fips140 module prior to the fix in change list 840685
Go projects relying on module resolution through user-configurable GOMODPROXY
Developer workstations building untrusted Go source trees

Discovery Timeline

2026-10-08 - CVE-2026-94444 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-94444

Vulnerability Analysis

The Go toolchain ships golang.org/fips140 as a bundled module to provide a trusted FIPS 140 cryptographic implementation. The toolchain previously resolved this module through the standard module proxy workflow when a project declared it as a dependency. A malicious project that declares a bogus golang.org/fips140 entry can direct the toolchain to fetch the module from a GOMODPROXY the user has configured. If that proxy is also attacker-controlled, it can serve arbitrary content that the toolchain treats as the trusted FIPS 140 module.

The fix unpacks the trusted ziphash for the bundled golang.org/fips140 module and constructs its entry directly in the GOMODCACHE. The toolchain then verifies the module against the known-good hash, preventing substitution by any upstream proxy.

Root Cause

The root cause is improper validation of integrity information [CWE-354]. The toolchain did not pin the bundled FIPS 140 module to its trusted ziphash before module resolution, so a bogus module declaration combined with a hostile proxy could override the trusted bytes.

Attack Vector

Exploitation requires local user interaction. A developer must open or build a malicious Go project while a GOMODPROXY under attacker control is configured. The toolchain then retrieves attacker-supplied module content in place of the trusted FIPS 140 module. Resulting code runs with the privileges of the developer executing the build.

No verified exploit code is public. Technical details are described in the Go.dev Vulnerability Advisory and the Go.dev Issue Tracker.

Detection Methods for CVE-2026-94444

Indicators of Compromise

Unexpected golang.org/fips140 entries in a project's go.mod or go.sum that do not match hashes shipped by the Go toolchain
Build-time network connections to non-standard GOMODPROXY hosts not sanctioned by the organization
Modified contents under $GOMODCACHE/cache/download/golang.org/fips140/ that differ from the trusted bundle

Detection Strategies

Compare go.sum hashes for golang.org/fips140 against the trusted hashes referenced in the Go.dev Change Log
Audit developer environments for GOPROXY, GOMODPROXY, and GOPRIVATE values that bypass the public Go module proxy or checksum database
Flag Go build processes that spawn unexpected child processes or make outbound connections during module resolution

Monitoring Recommendations

Collect process and network telemetry from developer endpoints during go build, go mod download, and CI module resolution
Alert on changes to GOMODCACHE contents that occur outside signed toolchain updates
Track go env configuration drift across developer workstations and build agents

How to Mitigate CVE-2026-94444

Immediate Actions Required

Upgrade to a patched Go toolchain release that includes change list 840685 as announced on the Golang Announce list
Review and reset GOPROXY and GOMODPROXY settings on developer workstations and CI runners to trusted values such as proxy.golang.org
Avoid building untrusted Go projects on workstations that have custom module proxies configured

Patch Information

The fix is tracked in Go issue 81833 and merged via change list 840685. The patched toolchain unpacks the trusted ziphash for the bundled golang.org/fips140 module and seeds the GOMODCACHE entry so the toolchain verifies the module against the known-good hash. Refer to the Go.dev Vulnerability Advisory GO-2026-6601 for version mapping.

Workarounds

Set GOFLAGS=-mod=readonly and enforce verification through GOSUMDB=sum.golang.org to detect module substitution
Restrict build environments to the official proxy.golang.org and prohibit per-project overrides of GOMODPROXY
Isolate builds of untrusted Go source in ephemeral sandboxes without access to internal module proxies

bash

# Pin the Go module proxy and checksum database to trusted values
go env -w GOPROXY=https://proxy.golang.org,direct
go env -w GOSUMDB=sum.golang.org
go env -w GOFLAGS=-mod=readonly