Is CVE-2026-94447 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94447 being exploited in the wild.

How severe is CVE-2026-94447?

High severity, with a CVSS score of 7.8, published 8 October 2026.

Which products and versions are affected?

toolchain (Go) 1.26.0 through 1.26.8, 1.27.0-0 through 1.27.1, SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.

How is CVE-2026-94447 attacked?

It is attacked from the adjacent network or with local access, in a software library.

Am I affected by CVE-2026-94447?

Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94447: Go toolchain checksum database bypass in cmd/go

CVE-2026-94447 · Severity: high · CVSS 7.8 · Published 2026-10-08

Go's package manager cmd/go can be tricked into accepting malicious golang.org/toolchain packages when a user operates within a malicious Go project. An attacker who controls a GOMODPROXY can inject a fake toolchain version with a forged checksum, bypassing Go's checksum verification and potentially executing arbitrary code on the developer's machine.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-94447 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94447 being exploited in the wild.
How severe is CVE-2026-94447?: High severity, with a CVSS score of 7.8, published 8 October 2026.
Which products and versions are affected?: toolchain (Go) 1.26.0 through 1.26.8, 1.27.0-0 through 1.27.1, SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.
Is there a fix for CVE-2026-94447?: Yes. toolchain (Go): upgrade to 1.27.2 or later. Until then: Avoid checking out or working within untrusted Go projects that may contain malicious go.sum entries or configure GOMODPROXY to only use trusted, controlled proxy servers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94447 attacked?: It is attacked from the adjacent network or with local access, in a software library.
Am I affected by CVE-2026-94447?: Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toolchain (Go): upgrade to 1.27.2 or later
```
go get toolchain@v1.27.2
```

Avoid checking out or working within untrusted Go projects that may contain malicious go.sum entries or configure GOMODPROXY to only use trusted, controlled proxy servers.

Technical details

The vulnerability exists in cmd/go's handling of golang.org/toolchain checksums. A user within a malicious Go project can define a bogus golang.org/toolchain entry in go.sum and use a malicious GOMODPROXY to serve counterfeit toolchain packages, causing cmd/go to accept an unverified checksum. The fix ensures golang.org/toolchain always performs network verification for canonical checksums rather than relying on cached or proxy-provided values.

Affected products

Go toolchain 1.26.0 through 1.26.8, 1.27.0-0 through 1.27.1

Identifiers

CVE-2026-94447
GO-2026-6602

Timeline

2026-10-08: disclosed
2026-10-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.