# CVE-2026-94444: Go toolchain checksum bypass in cmd/go

Source: https://junglewise.ai/threats/cve-2026-94444-go-2026-6601-checksum-bypass-for-golang-org-fips140-in-cmd-go  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-10  
License: CC BY 4.0 with a link back

CVE-2026-94444 · Severity: high · CVSS 7.8 · Published 2026-10-08

The Go toolchain's package management system (cmd/go) fails to properly verify the checksum of the bundled golang.org/fips140 cryptographic module. An attacker who controls a malicious Go project and a GOMODPROXY server could trick a developer into downloading and using an arbitrary module instead of the legitimate FIPS 140-2 module, potentially introducing compromised cryptographic code into applications. This bypasses security controls meant to ensure the integrity of cryptographic dependencies.

Technologies: [toolchain (Go)](https://junglewise.ai/threats/technologies/toolchain), [Google Go](https://junglewise.ai/threats/technologies/google-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-94444 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94444 being exploited in the wild.

**How severe is CVE-2026-94444?** High severity, with a CVSS score of 7.8, published 8 October 2026.

**Which products and versions are affected?** toolchain (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2; Google Go before 1.26.9; 1.27.0 before 1.27.2.

**Is there a fix for CVE-2026-94444?** Yes. toolchain (Go): upgrade to 1.27.2 or later. Until then: Avoid downloading and building code from untrusted Go projects or when configured to use GOMODPROXY servers you do not control, until upgrading to a patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94444 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-94444?** Check whether you run toolchain (Go) or Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toolchain (Go): upgrade to 1.27.2 or later

  ```sh
  go get toolchain@v1.27.2
  ```


Avoid downloading and building code from untrusted Go projects or when configured to use GOMODPROXY servers you do not control, until upgrading to a patched version.

## Technical details

The vulnerability is a checksum bypass in Go's module proxy handling where a user inside a malicious project defining a bogus golang.org/fips140 module combined with a malicious GOMODPROXY can serve an arbitrary module in place of the legitimate one. The attack requires the attacker to control both the Go project context and the GOMODPROXY endpoint, but does not require authentication or user interaction beyond the normal build process. The fix unpacks the trusted ziphash for the bundled golang.org/fips140 module and properly constructs its entry in the GOMODCACHE for verification by the toolchain.

## Affected products

- Google Go before 1.26.9; 1.27.0 before 1.27.2

## Identifiers

- CVE-2026-94444
- GO-2026-6601

## Timeline

- 2026-10-08: disclosed
- 2026-10-08: patched: Fix released in Go 1.26.9 and 1.27.2

## References

- [https://go.dev/cl/840685](https://go.dev/cl/840685)
- [https://go.dev/issue/81833](https://go.dev/issue/81833)

## Related threats

- [Go HTTP/1 server race condition in MaxBytesReader header handling](https://junglewise.ai/threats/cve-2026-97054-for-http-1-servers-when-maxbytesreader-s-limit-is-exceeded)
- [Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo)
- [Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or)
- [Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler)
- [Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass)