VDB
CVE-2026-94447
CVE-2026-94447
PUBLISHED
CVSS 7.8 HIGH
Reported by Go · Published October 8, 2026
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
Risk Scores
CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0, 1.27.0-0 |
| chainguard | calico-fips-3.32 | * |
| chainguard | gitlab-rails-ce-18.11 | * |
| chainguard | nvidia-nsight-compute-12.8 | 0 |
| chainguard | calico-fips-3.30 | * |
| chainguard | nemo-gym | 0 |
| chainguard | nemo | 0 |
| chainguard | go-slim-1.25 | * |
| chainguard | nvidia-nsight-compute-13.4 | 0 |
| chainguard | datadog-agent-7.77 | * |
| chainguard | calico-3.31 | * |
| chainguard | gitlab-rails-ce-18.9 | * |
| wolfi | datadog-agent-7.77 | * |
| chainguard | gitlab-rails-ce-19.0 | * |
| chainguard | nvidia-nsight-compute-13.3 | 0 |
| chainguard | nvidia-nsight-compute-12.9 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | * |
| chainguard | commercial-nginx-ingress | 0 |
| alpine | go | 0, 0 |
| wolfi | go-1.25 | * |
…and 23 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 15, 2026 CVE Updated
- Oct 16, 2026 EPSS Score
- Oct 26, 2026 Distribution Patch
- Oct 28, 2026 Distribution Patch
- Oct 29, 2026 Distribution Patch
- Oct 29, 2026 Security Advisory