CVE-2026-94447: Go Toolchain Auth Bypass Vulnerability

CVE-2026-94447 Overview

CVE-2026-94447 is a checksum verification bypass in the Go toolchain affecting the golang.org/toolchain module resolution process. A user working inside a malicious Go project can be tricked into trusting a forged toolchain if the project defines a bogus golang.org/toolchain entry in go.sum and the user has configured a malicious GOMODPROXY. The flaw allows the attacker-controlled proxy to serve a tampered toolchain that passes integrity checks, leading to arbitrary code execution in the developer's environment. The Go team addressed the issue by forcing golang.org/toolchain lookups to always fetch the canonical checksum from the network. The weakness is tracked as [CWE-354: Improper Validation of Integrity Check Value].

Critical Impact
A malicious Go module combined with a hostile module proxy can deliver a backdoored Go toolchain that executes with the developer's privileges during build operations.

Affected Products

Go toolchain distribution mechanism (golang.org/toolchain)
Go projects relying on GOMODPROXY for module resolution
Developer workstations and CI runners executing untrusted Go modules

Discovery Timeline

2026-10-08 - CVE-2026-94447 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-94447

Vulnerability Analysis

The Go toolchain supports automatic switching to the toolchain version declared in a project's go.mod file. Toolchain archives are distributed as modules under the golang.org/toolchain path and are fetched through the configured module proxy. Like other modules, they are validated against entries in go.sum.

The defect is that the toolchain fetch trusted the project-local go.sum entry rather than requiring the canonical checksum from the Go checksum database. When a user opts into a hostile GOMODPROXY, the proxy can return any payload the attacker chooses, and the matching bogus hash in the committed go.sum satisfies verification. The toolchain archive then executes build and run commands on the developer's host.

The fix ensures that golang.org/toolchain always consults the network for the authoritative checksum, removing the ability of a project-local go.sum to pin an attacker-chosen hash.

Root Cause

The root cause is improper validation of an integrity check value [CWE-354]. The checksum consulted for toolchain downloads was taken from the untrusted project context instead of the authoritative upstream source, breaking the trust assumption that golang.org/toolchain modules are verified against known-good hashes.

Attack Vector

Exploitation requires local user interaction with an attacker-controlled project and a non-default proxy configuration. The attacker publishes a malicious Go repository containing a crafted go.mod that pins a specific toolchain version and a go.sum entry that matches the attacker's payload. The victim must have GOMODPROXY pointed at a proxy the attacker controls or can influence. When the victim runs go build, go run, or any command that triggers toolchain selection, Go downloads the forged toolchain, validates it against the bogus go.sum hash, and executes it.

See the Go Vulnerability Report GO-2026-6602 and the Go Issue Tracker Entry for the upstream technical write-up.

Detection Methods for CVE-2026-94447

Indicators of Compromise

Unexpected golang.org/toolchain entries in a project's go.sum that do not match hashes recorded by sum.golang.org.
GOMODPROXY or GOPROXY environment variables pointing to non-standard or untrusted hosts on developer or build systems.
New toolchain binaries appearing under $GOPATH/pkg/mod/golang.org/toolchain@* with hashes that differ from upstream releases.

Detection Strategies

Compare golang.org/toolchain hashes in committed go.sum files against the canonical values returned by sum.golang.org.
Audit CI/CD pipeline configurations and developer shell profiles for overrides to GOPROXY, GOMODPROXY, GOSUMDB, or GONOSUMCHECK.
Alert on process executions where a Go toolchain binary from pkg/mod/golang.org/toolchain@* spawns unexpected child processes such as shells or network utilities.

Monitoring Recommendations

Log and review changes to go.mod and go.sum in version control, with focus on toolchain directives.
Centralize module proxy traffic through an approved internal proxy and block egress from build nodes to arbitrary external proxies.
Capture command-line telemetry for go invocations on developer and build hosts to identify anomalous toolchain downloads.

How to Mitigate CVE-2026-94447

Immediate Actions Required

Upgrade the Go toolchain to the patched release that forces network checksum validation for golang.org/toolchain, as described in the GoLang Announcement Group Post.
Reset GOPROXY and GOMODPROXY to trusted values such as https://proxy.golang.org,direct and ensure GOSUMDB is enabled.
Audit recent build artifacts produced from untrusted repositories and rebuild them with the patched toolchain.

Patch Information

The Go team released the fix via the change tracked in the Go Developer Announcement and documented in Go Vulnerability Report GO-2026-6602. After patching, golang.org/toolchain module fetches bypass the project-local go.sum entry and consult the authoritative checksum source over the network.

Workarounds

Avoid executing go commands inside untrusted repositories until the toolchain is patched.
Pin GOTOOLCHAIN=local to disable automatic toolchain downloads when operating on untrusted code.
Enforce GOPROXY=https://proxy.golang.org,direct and leave GOSUMDB=sum.golang.org enabled across developer and CI environments.

bash

# Configuration example
go env -w GOTOOLCHAIN=local
go env -w GOPROXY=https://proxy.golang.org,direct
go env -w GOSUMDB=sum.golang.org
go env -u GOMODPROXY