Go Toolchain CVE-2026-56865

Exploitation requires three concurrent conditions: (1) the victim's Go toolchain is a vulnerable version - cmd/go < 1.25.13, cmd/go 1.26.x < 1.26.6, or cmd/go 1.27.x < 1.27.0-rc.2; (2) the GOPROXY environment variable is configured to point to an attacker-controlled or attacker-compromised proxy endpoint - the official default proxy at proxy.golang.org is not attacker-controlled under normal conditions, so developers relying solely on the default are not exposed to an external attacker; and (3) the developer or an automated process invokes a Go module command (go mod tidy, go get, go build with module fetching) that causes the toolchain to fetch sumdb tiles through the malicious proxy. Exploitation is specifically bounded by the two-tile forgery limit - the attacker cannot forge an arbitrarily deep subtree, constraining the manipulable module scope. GONOSUMCHECK or GONOSUMDB configurations already bypass GOSUMDB entirely and are separately out of scope.

The NVD-assigned CVSS base score of 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H warrants direct scrutiny: the AV:L (Local) metric is inconsistent with the actual attack mechanism, which is delivered via a network-accessible GOPROXY server - AV:N with AC:H and UI:R more accurately reflects the prerequisites. AC:L and UI:N further overstate ease of exploitation, since the victim toolchain must be configured to a malicious proxy and a developer or automated process must invoke go module commands. The EPSS score of 0.12% at the 3rd percentile signals negligible current exploitation activity, consistent with the absence of a CISA KEV listing. Real-world risk is therefore substantially lower than the raw CVSS score implies: the practical attack surface is narrowed to environments where GOPROXY is directed at an untrusted or compromised endpoint, which is uncommon in well-governed developer environments. The most plausible threat actor is a sophisticated supply chain attacker, not an opportunistic scanner. The 'JWT Attack' tag in the source intelligence data appears to be a metadata classification error - this vulnerability involves Go sumdb tile verification, not JSON Web Tokens.

An attacker deploys a malicious GOPROXY server (e.g., via typosquatting a popular internal proxy hostname, compromising an organizational proxy, or social engineering a team's GOPROXY configuration) and pre-stages forged sumdb tile pairs that reference attacker-controlled module content. When a developer or CI/CD job runs 'go mod tidy' or 'go get' against a targeted module, the vulnerable toolchain fetches and accepts the forged tiles without verifying ancestry, writes the malicious module content to the local cache, and subsequent builds compile and execute the attacker's code - all without any transparency log anomaly visible through standard tooling. No public exploit code has been identified at time of analysis.