Skip to main content

Go Toolchain CVE-2026-56865

| EUVDEUVD-2026-58513 HIGH
Improper Verification of Cryptographic Signature (CWE-347)
2026-08-13
Authentication Bypass Jwt Attack
8.4
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Attack is network-delivered via malicious GOPROXY (AV:N); requires victim proxy misconfiguration (AC:H); user must invoke go commands (UI:R); no privileges on victim system required (PR:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 14, 2026 - 16:34 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 14, 2026 - 16:22 vuln.today
cvss_changed
CVSS changed
Aug 14, 2026 - 16:22 NVD
8.4 (HIGH)
Patch available
Aug 13, 2026 - 23:04 EUVD
Analysis Generated
Aug 13, 2026 - 22:16 vuln.today
CVE Published
Aug 13, 2026 - 20:40 oss-security
MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the victim's Go toolchain is a vulnerable version - cmd/go < 1.25.13, cmd/go 1.26.x < 1.26.6, or cmd/go 1.27.x < 1.27.0-rc.2; (2) the GOPROXY environment variable is configured to point to an attacker-controlled or attacker-compromised proxy endpoint - the official default proxy at proxy.golang.org is not attacker-controlled under normal conditions, so developers relying solely on the default are not exposed to an external attacker; and (3) the developer or an automated process invokes a Go module command (go mod tidy, go get, go build with module fetching) that causes the toolchain to fetch sumdb tiles through the malicious proxy. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS base score of 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H warrants direct scrutiny: the AV:L (Local) metric is inconsistent with the actual attack mechanism, which is delivered via a network-accessible GOPROXY server - AV:N with AC:H and UI:R more accurately reflects the prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade the Go toolchain to version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later, matching the release track in use. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all developer workstations and CI/CD infrastructure running Go versions prior to 1.25.13, 1.26.6, or 1.27.0-rc.3, and communicate the vulnerability to engineering leadership with guidance to avoid non-default GOPROXY configurations. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jwt Attack

View all
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2026-48558 CRITICAL POC
9.5 Jun 12

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
CVE-2025-59718 CRITICAL
9.8 Dec 09

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
CVE-2025-25291 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2025-25292 CRITICAL POC
9.3 Mar 12

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
CVE-2022-25898 CRITICAL POC
9.8 Jul 01

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT

CVE-2024-42004 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
CVE-2024-41145 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
CVE-2024-41138 CRITICAL POC
9.8 Dec 18

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work

CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-35929 CRITICAL POC
9.8 Aug 04

cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2022-31053 CRITICAL POC
9.8 Jun 13

Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)

Same weakness CWE-347 – Improper Verification of Cryptographic Signature

View all
CVE-2013-3900 MEDIUM
5.5
CVE-2026-48558 CRITICAL POC
9.5
CVE-2025-59718 CRITICAL
9.8
CVE-2025-47827 MEDIUM POC
4.6
CVE-2025-25291 CRITICAL POC
9.3
CVE-2025-25292 CRITICAL POC
9.3
CVE-2022-25898 CRITICAL POC
9.8
CVE-2024-42004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-56865 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy