Go Toolchain EUVD-2026-95418

Exploitation requires two attacker-controlled preconditions that the victim must opt into: (1) the victim operates inside a malicious Go project whose go.sum contains a forged golang.org/toolchain checksum entry, and (2) the victim chooses to use an attacker-operated GOMODPROXY/GOPROXY module proxy. Limiting factors are significant: the attack is local (AV:L) and requires user interaction (UI:R) - the developer must run go tooling within the crafted project while pointed at the malicious proxy - so a trusted-input/social-engineering foothold is needed and default configurations using the public proxy with correct sums are not affected. Impact is bounded to hosts running vulnerable cmd/go versions (1.27.0 before 1.27.2, and before 1.26.9); patched toolchains force golang.org/toolchain to fetch the canonical checksum from the network.

Signals are consistent and point to a real-but-conditional risk rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) correctly reflects a local attack requiring user interaction: although PR:N indicates no authentication to the go tool, UI:R captures the key gate - the victim must choose to operate inside a malicious Go project AND opt into an attacker-controlled GOMODPROXY. This is effectively a supply-chain / social-engineering integrity bypass (CWE-354, improper validation of integrity check), not a remotely reachable service flaw. EPSS is very low (0.13%, 2nd percentile) and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of widespread or automatable exploitation; the attack requires a deliberately crafted project plus a chosen malicious proxy, making opportunistic mass exploitation implausible. No SSVC decision was provided in the input. The signals do not conflict: a HIGH CVSS driven by full C/I/A impact coexists cleanly with low EPSS because the local, interaction-gated, attacker-must-be-trusted-already preconditions sharply narrow real-world applicability. Prioritize patching on developer and CI hosts as hygiene, but this is not a drop-everything internet-facing issue.

An attacker publishes or convinces a developer to clone a malicious Go module whose go.sum contains a bogus golang.org/toolchain checksum entry, and persuades the victim to configure GOMODPROXY/GOPROXY to an attacker-controlled proxy. When the victim runs go commands, the forged go.sum entry is accepted and the toolchain is fetched from the malicious proxy, bypassing the intended canonical checksum and allowing a tampered Go toolchain to execute on the victim's machine. No public exploit is identified at time of analysis; the attack hinges on social-engineering the victim into the malicious project and proxy.