Go Toolchain EUVD-2026-95417

Exploitation requires a developer to (1) operate inside an attacker-crafted malicious Go project that defines a bogus golang.org/fips140 module, AND (2) choose to connect their build to an attacker-controlled GOMODPROXY. Both are attacker-supplied preconditions combined with explicit user action (running go module/build commands against the malicious proxy), reflected by UI:R and AV:L. Limiting factors: it is a local build-time vulnerability, not a remotely-reachable network service; it needs active developer participation and a non-default, attacker-chosen module proxy; and it affects only the Go toolchain versions below 1.26.9 and 1.27.0-1.27.1, with 1.26.9 and 1.27.2 fixed.

Signals are consistent and point to a real but conditional, not widespread, risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, 7.8 HIGH) describes a local, build-time integrity bypass requiring user interaction, not a remotely-reachable service flaw - despite PR:N, exploitation is gated by UI:R (the developer must build inside an attacker-crafted project AND choose to connect to a malicious GOMODPROXY). EPSS is very low (0.11%, 1st percentile) and the CVE is NOT in CISA KEV, and no public exploit was identified at time of analysis - all three low-exploitation signals agree with the high UI/local prerequisites, so this is a legitimately-rated HIGH that is nonetheless low on real-world mass-exploitation probability. The CWE-354 (improper validation of integrity check) classification and the fix (unpacking the trusted ziphash for the bundled golang.org/fips140 module so the toolchain can verify it) confirm the core issue is module substitution enabling attacker-controlled code to enter the build, which justifies the C:H/I:H/A:H impact. NOTE A CONFLICT: the input Tag labels this 'Information Disclosure', but the description and CWE-354 describe a supply-chain integrity/substitution flaw leading to code execution during build, not disclosure - the tag appears mislabeled and should not drive triage. No SSVC decision data was provided in the input.

A developer is lured into cloning and building a malicious Go project that defines a bogus golang.org/fips140 module and points the build at an attacker-controlled GOMODPROXY. When the developer runs a go build/module operation and connects to that proxy, the toolchain accepts an arbitrary module served in place of the trusted bundled golang.org/fips140, allowing the attacker's code into the build environment. No public exploit code was identified at time of analysis.