CVE-2026-94444: CWE-354: Improper Validation of Integrity Check Value in Go toolchain cmd/go
Description
CVE-2026-94444 is a vulnerability in the Go toolchain's cmd/go component involving improper validation of an integrity check value. A malicious Go project defining a bogus golang.org/fips140 module and controlling a malicious GOMODPROXY could serve an arbitrary module in place of the legitimate one. The issue has been addressed by unpacking and verifying the trusted ziphash for the bundled golang.org/fips140 module to ensure its integrity during caching.
Affected software
Go toolchain
cmd/go
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-354) in the Go toolchain cmd/go allows a user operating within a malicious Go project that defines a fake golang.org/fips140 module and uses a malicious GOMODPROXY to serve an arbitrary module instead of the legitimate one. The fix involves unpacking the trusted ziphash for the bundled golang.org/fips140 module and constructing its entry in the GOMODCACHE to enable verification by the toolchain, preventing substitution of malicious modules.
Potential Impact
An attacker controlling a malicious Go project and GOMODPROXY could cause the Go toolchain to accept and cache an arbitrary module in place of the legitimate golang.org/fips140 module. This could lead to supply chain compromise or execution of untrusted code during builds that rely on this module.
Mitigation Recommendations
The vulnerability is fixed in Go toolchain versions 1.26.9 and 1.27.2. Users should upgrade to at least these versions to ensure the integrity check validation is properly enforced. No additional mitigation is required if these versions are in use.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Go
- Date Reserved
- 2026-09-21T16:43:04.757Z
- State
- PUBLISHED
Threat ID: 6ac821642cdf04f6564170e2
Added to database: 10/08/2026, 23:04:04 UTC
Last enriched: 10/08/2026, 23:19:07 UTC
Last updated: 10/08/2026, 23:19:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.