Go toolchain EUVD-2026-28433

Exploitation requires developers to have explicitly configured an untrusted GOPROXY environment variable pointing to an attacker-controlled or compromised module proxy server, rather than using Go's default trusted proxy (proxy.golang.org with sum.golang.org checksum database). The attack triggers only when the go command attempts to download a different toolchain version than currently installed, which occurs when: (1) a project's go.mod or go.work file contains a 'toolchain' directive specifying a version different from the developer's installed version, OR (2) the GOTOOLCHAIN environment variable is set to 'auto' or a specific version different from the current installation. Default Go configurations using the official module proxy and checksum database are not vulnerable. The high attack complexity (AC:H) reflects the need for attackers to control the specific proxy endpoint in the developer's configuration and the requirement for user interaction (UI:R) through normal development workflow (running go build, go get, go mod tidy). No authentication is required from the attacker's perspective (PR:N) once positioned as the configured proxy. Organizations using Go with default settings, enterprise-managed trusted proxies, or direct module downloads (GOPROXY=direct) are not exposed to this vulnerability.

The CVSS 7.5 score (High severity with AV:N/AC:H/PR:N/UI:R) reflects network-based exploitation requiring high attack complexity and user interaction, while maintaining high impact across confidentiality, integrity, and availability. However, multiple risk signals suggest lower immediate real-world priority: EPSS score of 0.01% (1st percentile) indicates minimal observed exploitation activity, CISA SSVC framework rates exploitation as 'none' with 'not automatable', and no CISA KEV listing exists. The UI:R metric is crucial-exploitation requires developers to explicitly use untrusted GOPROXY configurations, which violates Go's secure-by-default stance (sum.golang.org is trusted by default). The AC:H rating aligns with the narrow attack surface: attackers must control or compromise the specific module proxy endpoint configured by the target, position themselves as man-in-the-middle for checksum database queries, AND time their attack to coincide with toolchain version switches. Despite total technical impact (arbitrary code execution in developer environments), the prerequisite of non-default proxy configuration significantly limits exposure. Organizations using default Go settings or enterprise-controlled proxies face minimal risk. However, for organizations that have deployed untrusted third-party proxies (common in air-gapped or restricted network environments), this represents critical supply chain risk with potential for persistent compromise through poisoned go.sum files.

An attacker operates a malicious module proxy (publicly available or compromised enterprise proxy) that a development team has configured via GOPROXY environment variable. When a developer works on a project with a go.mod file specifying 'toolchain go1.26.2', and their local installation is go1.25.9, the go command automatically attempts to download the specified toolchain version from the configured proxy. The malicious proxy serves a backdoored toolchain binary while returning an empty checksum database response that exploits the validation flaw. The developer's go command incorrectly accepts the altered toolchain, executes it with full developer privileges, and records the incorrect hash in go.sum, establishing persistence for future builds across the team.