Skip to main content

Go Toolchain CVE-2026-56864

| EUVDEUVD-2026-58514 HIGH
Improper Verification of Cryptographic Signature (CWE-347)
2026-08-13
Information Disclosure Red Hat Jwt Attack
7.5
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
8.0 HIGH

AC:H because attack requires coordinating a malicious GOPROXY and GOSUMDB; UI:R because developer must run go commands; S:C and I:H because malicious module code affects compiled applications beyond the toolchain itself.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE
HIGH
qualitative
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

6
Analysis Updated
Aug 14, 2026 - 17:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 14, 2026 - 17:22 vuln.today
cvss_changed
CVSS changed
Aug 14, 2026 - 17:22 NVD
7.5 (HIGH)
Patch available
Aug 13, 2026 - 23:04 EUVD
Analysis Generated
Aug 13, 2026 - 22:16 vuln.today
CVE Published
Aug 13, 2026 - 20:40 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.

Technical ContextAI

The Go module proxy ecosystem uses GOSUMDB (by default sum.golang.org) as a tamper-evident, append-only transparency log backed by a Merkle tree to record cryptographic hashes of every published module version. When a developer runs 'go get' or 'go mod tidy', cmd/go is expected to verify that any hash returned by the GOSUMDB is genuinely reflected in the public transparency log - a property that prevents a rogue server from inventing hashes off-ledger. CWE-347 (Improper Verification of Cryptographic Signature) identifies the root cause: the client failed to fully enforce that the served tile or hash proof was actually incorporated into the canonical log. This means a GOSUMDB under attacker control could present a hash that satisfies local consistency checks without being auditable by third-party log monitors. The affected components per EUVD are cmd/go versions 0 through 1.25.12, 1.26.0 through 1.26.5, and 1.27.0 pre-release builds before rc.3, as well as the standalone golang.org/x/mod/sumdb library before 0.40.0. Code changes are referenced in changelists go.dev/cl/815000 and go.dev/cl/815020.

RemediationAI

Upgrade cmd/go to version 1.25.13 or later for the 1.25.x branch, 1.26.6 or later for the 1.26.x branch, or 1.27.0-rc.3 or later for the 1.27 pre-release branch. If using the golang.org/x/mod/sumdb library directly, upgrade to version 0.40.0 or later. After upgrading, run the vendor-recommended recovery command 'rm -r go.sum go.work.sum vendor/ && go mod tidy' against a trusted GOPROXY and GOSUMDB to regenerate checksums from a verified source; skipping this step leaves potentially tampered go.sum entries in place. As a pre-patch compensating control, setting GONOSUMDB=* disables GOSUMDB verification entirely but also eliminates all transparency log protection and should only be used in air-gapped environments with a trusted private proxy. Alternatively, setting GOFLAGS=-mod=vendor and auditing vendor directory contents manually prevents new dependency fetches but does not address previously fetched content. Neither workaround is a substitute for patching. Advisory references: https://go.dev/issue/80481, https://seclists.org/oss-sec/2026/q3/487, https://pkg.go.dev/vuln/GO-2026-6180.

More in Jwt Attack

View all
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2026-48558 CRITICAL POC
9.5 Jun 12

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
CVE-2025-59718 CRITICAL
9.8 Dec 09

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
CVE-2025-25291 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2025-25292 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2022-25898 CRITICAL POC
9.8 Jul 01

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT

CVE-2024-42004 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
CVE-2024-41145 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
CVE-2024-41138 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-35929 CRITICAL POC
9.8 Aug 04

cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2022-31053 CRITICAL POC
9.8 Jun 13

Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

View all
CVE-2013-3900 MEDIUM
5.5
CVE-2026-48558 CRITICAL POC
9.5
CVE-2025-59718 CRITICAL
9.8
CVE-2025-47827 MEDIUM POC
4.6
CVE-2025-25291 CRITICAL POC
9.3
CVE-2025-25292 CRITICAL POC
9.3
CVE-2022-25898 CRITICAL POC
9.8
CVE-2024-42004 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-56864 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy