Skip to main content

Cmd Go CVE-2026-27140

| EUVDEUVD-2026-20002 HIGH
Incorrect Authorization (CWE-863)
2026-04-08 Go
Authentication Bypass RCE Cmd Go Go Toolchain
8.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious SWIG files with 'cgo' filenames
  2. Delivery
    Distribute via package repository or dependency
  3. Exploit
    Developer initiates go build
  4. Execution
    cmd/go processes SWIG files
  5. Persist
    Trust layer bypass triggers payload
  6. Impact
    Execute arbitrary code in build context

Vulnerability Assessment

Weakness
CWE
CWE-863
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires victim to build a project using SWIG with attacker-controlled or compromised SWIG files containing 'cgo' in filenames. Victim must execute the build process. Affects SWIG build systems where input validation on filenames is insufficient. No authentication required; victim interaction (initiating build) is necessary.
Impact

Despite the CVSS base score of 8.8 (High), real-world risk is moderate and highly contextual. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible attack requiring user interaction, which in this case means a developer must actively build a malicious package. Attack complexity is low once the malicious package is crafted, but exploitation requires social engineering or repository compromise. The EPSS score of 0.01% (1st percentile) suggests security researchers and attackers have not prioritized this vulnerability, likely because it targets the narrow window of build-time execution rather than runtime. No confirmed active exploitation (not on CISA KEV list). The primary risk is to development environments and CI/CD pipelines that build untrusted Go code, particularly in supply chain attack scenarios. Organizations using dependency pinning, vendoring, and build isolation significantly reduce exposure. SSVC considerations: exploitation status is none, automatable after initial social engineering, technical impact is total compromise of build environment. Priority depends on threat model-high for organizations building external Go code, lower for hermetic build environments with vetted dependencies.
Exploit ScenarioDerived

An attacker publishes a seemingly legitimate Go package to a public repository or compromises an existing dependency. The package includes SWIG interface files with crafted filenames containing 'cgo' designed to bypass trust validation. When a developer runs 'go build' or 'go get' on a project using this malicious dependency, the Go toolchain processes the SWIG files and executes the embedded payload with the developer's privileges, compromising the workstation or build server. Publicly available exploit code exists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 13, 2026

Build-time remote code execution in Go toolchain (cmd/go) versions before 1.25.9 and 1.26.0-1.26.1 allows network attackers to execute arbitrary code during compilation by supplying malicious SWIG files with specially crafted filenames containing 'cgo'. User interaction required (developer must build the malicious package). No public exploit identified at time of analysis. EPSS score of 0.01% (1st percentile) indicates very low observed exploitation probability despite high CVSS 8.8 rating.

RemediationAI

Vendor-released patches available: upgrade Go toolchain to version 1.25.9 or later for the 1.25.x series, or version 1.26.2 or later for the 1.26.x series. Upgrading cmd/go eliminates the vulnerable SWIG filename parsing logic. Download patches from official Go release channels referenced in the security announcement at https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. For environments unable to immediately upgrade, implement defensive measures including strict dependency review before building external packages, isolated build environments with limited privileges, and repository verification to ensure source integrity. Review build logs for unexpected SWIG file processing. The upstream fix is documented in Go change https://go.dev/cl/763768 addressing issue https://go.dev/issue/78335.

Affected VersionsENISA

cmd/go 0 <1.25.9
cmd/go 1.26.0-0 <1.26.2

Affected Packages

go toolchain fix: 1.25.9, 1.26.2
euvd cmd_go fix: 1.25.9, 1.26.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

SWIG (Simplified Wrapper and Interface Generator) is used in Go to interface with C/C++ libraries. The Go build tool (cmd/go) processes SWIG files during compilation, particularly when using cgo for C interoperability. This vulnerability exploits insufficient validation of SWIG filenames containing the string 'cgo', allowing attackers to bypass trust boundaries in the build process. By crafting filenames and payloads that exploit this naming pattern, malicious code can be injected and executed with the privileges of the build process. The affected component is cpe:2.3:a:go_toolchain:cmd/go, specifically the build chain's handling of foreign function interface files. This represents a supply chain attack vector where poisoned dependencies or repositories could compromise developer workstations and build infrastructure at compilation time.

Know when Cmd Go gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 9.0 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Apr 13, 2026 - 14:22 NVD
8.8 (HIGH)
Patch released
Apr 08, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 08, 2026 - 01:06 nvd
N/A

DescriptionNVD

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Executive ViewAI

Why It Matters

Go toolchain versions before 1.25.9 and 1.26.0-1.26.1 contain a build-time remote code execution vulnerability that allows attackers to execute arbitrary code during package compilation when developers build malicious packages containing specially crafted SWIG files. This primarily impacts development teams and CI/CD pipelines that compile untrusted or compromised Go packages, potentially compromising build artifacts and internal systems.

Business Impact: High
Compensating Controls

Vendor-released patch: Go 1.25.9, 1.26.2 and later. Until patching is complete, restrict compilation of packages from untrusted sources, implement code review requirements for all dependencies before building, and isolate build environments with minimal network access to reduce exposure window.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment NEWS Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Cmd Go

View all
CVE-2026-42501 HIGH POC
7.5 May 07

The Go toolchain's module proxy validation can be bypassed by attackers controlling untrusted GOPROXY or GOSUMDB endpoin
CVE-2026-39817 MEDIUM
5.9 May 07

The Go toolchain's 'go tool pack' subcommand fails to sanitize output filenames when extracting archive files, allowing

CVE-2026-39819 MEDIUM
5.3 May 07

The Go toolchain's 'go bug' command creates temporary files with predictable names in the system temporary directory, al

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/356008 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1320/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1321/ REF https://access.redhat.com/errata/RHSA-2026:10217 REF https://access.redhat.com/errata/RHSA-2026:10219 REF https://access.redhat.com/errata/RHSA-2026:10704 REF https://access.redhat.com/errata/RHSA-2026:16021 REF https://access.redhat.com/errata/RHSA-2026:16024 REF https://access.redhat.com/errata/RHSA-2026:16494 REF https://access.redhat.com/errata/RHSA-2026:16497 REF https://access.redhat.com/errata/RHSA-2026:16498 REF https://access.redhat.com/errata/RHSA-2026:16694 REF https://access.redhat.com/errata/RHSA-2026:16697 REF https://access.redhat.com/errata/RHSA-2026:16698 REF https://access.redhat.com/errata/RHSA-2026:23246 REF https://access.redhat.com/errata/RHSA-2026:25182 REF https://access.redhat.com/errata/RHSA-2026:34099 REF https://access.redhat.com/errata/RHSA-2026:56854 REF https://access.redhat.com/errata/RHSA-2026:57408 REF https://access.redhat.com/errata/RHSA-2026:57545 REF https://access.redhat.com/security/cve/CVE-2026-27140 REF https://bugzilla.redhat.com/show_bug.cgi?id=2456341 REF https://go.dev/cl/763768 REF https://go.dev/issue/78335 REF https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU REF https://pkg.go.dev/vuln/GO-2026-4871 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27140.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy