Is CVE-2026-56864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56864 being exploited in the wild.

How severe is CVE-2026-56864?

High severity, with a CVSS score of 7.5, published 13 August 2026.

Which products and versions are affected?

golang.org/x/mod (Go) SEMVER:introduced=0,fixed=0.40.0; toolchain (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.

Is there a fix for CVE-2026-56864?

Yes. golang.org/x/mod (Go): upgrade to 0.40.0 or later; toolchain (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56864 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-56864?

Check whether you run golang.org/x/mod (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56864: Go GOSUMDB malicious module content bypass

CVE-2026-56864 · Severity: high · CVSS 7.5 · Published 2026-08-13

Go's module dependency system relies on a transparency log (GOSUMDB) to verify that downloaded modules are authentic and unmodified. A vulnerability allows a malicious GOSUMDB server, working in coordination with a compromised proxy, to serve fake module code that bypasses the transparency log verification. An attacker could trick developers into using backdoored versions of legitimate open-source libraries, potentially compromising any software built with the affected dependencies.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-56864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56864 being exploited in the wild.
How severe is CVE-2026-56864?: High severity, with a CVSS score of 7.5, published 13 August 2026.
Which products and versions are affected?: golang.org/x/mod (Go) SEMVER:introduced=0,fixed=0.40.0; toolchain (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.
Is there a fix for CVE-2026-56864?: Yes. golang.org/x/mod (Go): upgrade to 0.40.0 or later; toolchain (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56864 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-56864?: Check whether you run golang.org/x/mod (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/mod (Go): upgrade to 0.40.0 or later
```
go get golang.org/x/mod@v0.40.0
```
toolchain (Go): upgrade to 1.27.0-rc.3 or later
```
go get toolchain@v1.27.0-rc.3
```

Technical details

The vulnerability exists in Go's module verification logic, which fails to adequately validate module content served by GOPROXY when GOSUMDB is compromised or malicious. The attack requires coordination between both the GOPROXY and GOSUMDB servers to succeed—the GOSUMDB can serve content not present in the transparency log without detection. An attacker must have control over or be able to man-in-the-middle both the proxy and sum database services. A developer running `go mod tidy` or similar commands will download and use the malicious module without warning. Patches should be available in updated Go releases that strengthen transparency log validation.

Affected products

Google Go affected versions prior to patch

Identifiers

CVE-2026-56864
GO-2026-6180

Timeline

2026-08-13: disclosed
2026-08-13: advisory: CVE-2026-56864

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.