CVE-2026-27140: Code execution vulnerability in SWIG code generation in cmd/go

Modified

AliasesRHSA-2026:16494RHSA-2026:16497RHSA-2026:16498+7448 more

Published 08-04-2026Last modified 10-09-2026

Vulnerability summary

CVE-2026-27140 is a high (CVSS 8.8) Incorrect Authorization vulnerability in go toolchain cmd/go. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.66%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

08-04-2026
PublishedVulnerability first disclosed.
10-09-2026
Last modifiedVulnerability information updated.

Description

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

CVSS metrics

8 scores · 8 sources · 1 version

v3.18.8

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.66% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r53
act< 0.2.87-r2
actions-runner-controller< 0.14.1-r0
actions-runner-controller-fips< 0.14.1-r0
addon-resizer< 1.8.23-r17

addon-resizer-fips< 1.8.23-r18
age< 1.3.1-r5
age-fips< 1.3.1-r7
agentbeat< 9.2.7-r4
agentbeat-fips< 9.2.7-r5
amass< 5.1.1-r5 | < 5.1.1-r0
amazon-cloudwatch-agent< 1.300066.1-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300066.1-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300069.0-r1
amazon-cloudwatch-agent-config-downloader< 1.300066.1-r2
amazon-cloudwatch-agent-config-downloader-fips< 1.300069.0-r1
amazon-cloudwatch-agent-config-translator< 1.300066.1-r2
amazon-cloudwatch-agent-config-translator-fips< 1.300069.0-r1
amazon-cloudwatch-agent-fips< 1.300069.0-r1
amazon-cloudwatch-agent-operator< 3.4.2-r3
amazon-cloudwatch-agent-operator-fips< 3.4.2-r4 | < 3.3.3-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300066.1-r2
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300069.0-r1
amazon-ecs-agent< 1.103.2-r0
amazon-ecs-agent-fips< 1.103.2-r0
amazon-ecs-cni-plugins< 2024.9.0_git20260522-r1
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260306-r2
amazon-eks-ami< 20260527-r0
amazon-eks-ami-fips< 20260527-r0
amazon-k8s-cni< 1.21.1-r5 | < 1.22.1-r0
amazon-k8s-cni-compat< 1.21.1-r5
amazon-k8s-cni-fips< 1.21.1-r6
amazon-k8s-cni-init< 1.22.1-r0 | < 1.21.1-r5
amazon-k8s-cni-init-compat< 1.21.1-r5
amazon-k8s-cni-init-fips< 1.21.1-r6
amazon-k8s-cni-init-fips-compat< 1.21.1-r6
amazon-ssm-agent< 3.3.4515.0-r2
amazon-ssm-agent-ecs-exec< 3.3.4515.0-r2
amazon-ssm-agent-ecs-exec-fips< 3.3.4515.0-r3
amazon-ssm-agent-fips< 3.3.4515.0-r3
amazon-vpc-cni-plugins< 1.3_git20260307-r4
amazon-vpc-cni-plugins-fips< 1.3_git20260307-r2
apache-beam-java-11-sdk< 2.73.0-r0
apache-beam-java-17-sdk< 2.73.0-r0
apache-beam-java-21-sdk< 2.73.0-r0
apache-beam-python-3.11-sdk< 2.73.0-r6
apache-beam-python-3.12-sdk< 2.72.0-r2
apache-beam-python-3.13-sdk< 2.73.0-r4
apache-exporter< 1.0.12-r6
apisix-ingress-controller< 2.0.1-r10
apko< 1.2.15-r0
apko-fips< 1.2.3-r0
apm-server-8.18All versions (No fix recorded)
apm-server-fips-8.18All versions (No fix recorded)
argo-cd-2.14All versions (No fix recorded)
argo-cd-2.14-compatAll versions (No fix recorded)
argo-cd-3.0< 3.0.23-r5
argo-cd-3.0-compat< 3.0.23-r5
argo-cd-3.1< 3.1.13-r4
argo-cd-3.1-compat< 3.1.13-r4
argo-cd-3.3< 3.3.6-r4 | < 3.3.7-r0
argo-cd-3.3-compat< 3.3.7-r0
argo-cd-fips-2.14All versions (No fix recorded)
argo-cd-fips-2.14-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.23-r6
argo-cd-fips-3.0-compat< 3.0.23-r6
argo-cd-fips-3.2< 3.2.8-r5
argo-cd-fips-3.2-compat< 3.2.8-r5
argo-events< 1.9.10-r24
argo-events-fips< 1.9.10-r9
argo-rollouts< 1.9.0-r7
argo-rollouts-fips< 1.9.0-r3
argo-workflow-controller-3.6< 3.6.19-r6
argo-workflow-controller-3.7< 3.7.13-r1
argo-workflow-controller-fips-3.6< 3.6.19-r7
argo-workflow-controller-fips-3.7< 3.7.13-r5
argo-workflow-executor-3.6< 3.6.19-r6
argo-workflow-executor-3.7< 3.7.13-r1
argo-workflow-executor-fips-3.6< 3.6.19-r7
argo-workflow-executor-fips-3.7< 3.7.13-r5
argo-workflows-3.6< 3.6.19-r6
argo-workflows-3.7< 3.7.13-r1
argo-workflows-fips-3.6< 3.6.19-r7
argo-workflows-fips-3.7< 3.7.13-r5
argocd-image-updater< 1.1.1-r8
argocd-image-updater-fips< 1.2.1-r1
atlantis< 0.42.0-r0
atlantis-fips< 0.41.0-r2
atlas-1.0< 1.0.0-r3
atlas-1.0-fips< 1.0.0-r6
atlas-1.1-fips< 1.1.0-r3
auditbeat-7< 7.17.29-r13
auditbeat-8.17< 8.17.10-r13
auditbeat-8.18All versions (No fix recorded)
auditbeat-fips-7< 7.17.29-r15
auditbeat-fips-8.17< 8.17.10-r12
auditbeat-fips-8.18All versions (No fix recorded)
auditbeat-fips-8.19< 8.19.14-r3
auditbeat-fips-9.0< 9.0.8-r15
authservice< 1.1.5-r7
authservice-fips< 1.1.5-r7
aws-application-networking-k8s< 2.0.2-r8
aws-application-networking-k8s-fips< 2.0.2-r1
aws-ebs-csi-driver-1.50< 1.50.3-r8
aws-ebs-csi-driver-1.51< 1.51.2-r8
aws-ebs-csi-driver-1.52< 1.52.1-r13 | < 1.52.1-r10
aws-ebs-csi-driver-1.53< 1.53.0-r8
aws-ebs-csi-driver-1.54< 1.54.0-r13
aws-ebs-csi-driver-fips-1.50< 1.50.3-r8
aws-ebs-csi-driver-fips-1.54< 1.54.0-r11
aws-ebs-csi-driver-fips-1.55< 1.55.0-r11
aws-efs-csi-driver< 3.2.0-r1
aws-efs-csi-driver-fips< 3.2.0-r1
aws-eks-pod-identity-agent< 0.1.37-r0
aws-eks-pod-identity-agent-fips< 0.1.37-r1
aws-flb-cloudwatch< 1.9.5-r2
aws-flb-cloudwatch-fips< 1.9.4-r23
aws-flb-firehose< 1.7.2-r26
aws-flb-firehose-fips< 1.7.2-r23
aws-flb-kinesis< 1.10.4-r2
aws-flb-kinesis-fips< 1.10.3-r10
aws-fsx-csi-driver< 1.9.0-r4 | < 1.8.0-r6
aws-fsx-csi-driver-fips< 1.9.0-r4
aws-iam-authenticator< 0.7.16-r1
aws-iam-authenticator-fips< 0.7.12-r0
aws-load-balancer-controller< 3.2.1-r0
aws-load-balancer-controller-fips< 3.2.1-r0
aws-network-policy-agent< 1.3.2-r2
aws-network-policy-agent-fips< 1.3.5-r1
aws-node-termination-handler< 1.25.6-r9
aws-nuke< 3.65.0-r0
aws-nuke-fips< 3.64.1-r1
aws-otel-collector-fips< 0.47.0-r8
aws-otel-collector-healthcheck-fips< 0.47.0-r8
aws-privateca-issuer< 1.8.1-r7
aws-privateca-issuer-fips< 1.8.1-r1
aws-s3-controller< 1.3.2-r5
aws-signer-notation-plugin< 1.0.2292-r15
aws-signer-notation-plugin-fips< 1.0.2292-r10
aws-sigv4-proxy< 1.11.1-r9
aws-sigv4-proxy-fips< 1.11.1-r5
azure-aad-pod-identity-mic< 1.8.17-r38
azure-aad-pod-identity-nmi< 1.8.17-r38
azure-ipam< 0.4.0-r23
azure-ipam-dropgz< 0.4.0-r23
azure-service-operator< 2.18.0-r6
azure-service-operator-fips< 2.18.0-r5
azure-vnet-cni< 1.8.7-r1
azure-workload-identity-webhook< 1.5.1-r20
azuredisk-csi-1.31< 1.31.12-r13
azuredisk-csi-fips-1.31< 1.31.12-r13
azurefile-csi-1.31< 1.31.8-r12
azurefile-csi-1.32< 1.32.9-r10
azurefile-csi-fips-1.31< 1.31.8-r13
azurefile-csi-fips-1.32< 1.32.9-r8
backup-restore-operator-7.0< 7.0.5-r7
backup-restore-operator-fips-9.0< 9.0.3-r2
bank-vaults< 1.32.1-r19
bank-vaults-fips< 1.32.1-r7
bank-vaults-template< 1.32.1-r19
bank-vaults-template-fips< 1.32.1-r7
bazelisk< 1.29.0-r2
bento< 1.17.0-r1
blob-csi-1.23< 1.23.11-r74
blob-csi-1.24< 1.24.11-r22
blob-csi-1.25< 1.25.10-r19 | < 1.25.10-r15
blob-csi-fips-1.23< 1.23.11-r75
blob-csi-fips-1.24< 1.24.11-r22
blob-csi-fips-1.26< 1.26.10-r5
blob-csi-fips-1.27< 1.27.3-r5
blobfuse2< 2.4.2-r13
blobfuse2-fips< 2.4.2-r12
blobfuse2-fips-health-monitor< 2.4.2-r12
blobfuse2-health-monitor< 2.4.2-r13
bom< 0.7.1-r21
boring-registry< 0.17.0-r4
boringssl-fips-static-2023042800-tools< 2023042800-r12
boringssl-fips-static-20240407-tools< 20240407-r4
buf< 1.68.3-r0
buildah< 1.44.0-r0
buildah-fips< 1.44.0-r0 | < 1.43.1-r1
buildkite-agent< 3.123.1-r0
buildkite-agent-fips< 3.123.1-r0
buildtools-buildifier< 8.5.1-r5 | < 8.5.1-r8
buildtools-buildifier-fips< 8.5.1-r7
buildtools-buildozer< 8.5.1-r8 | < 8.5.1-r5
buildtools-buildozer-fips< 8.5.1-r4 | < 8.5.1-r7
caddy< 2.11.2-r11
cadence< 1.4.0-r8
cadence-cassandra-tool< 1.4.0-r8
cadence-fips< 1.4.0-r8
cadence-fips-cassandra-tool< 1.4.0-r8
cadence-fips-server< 1.4.0-r8
cadence-fips-sql-tool< 1.4.0-r8
cadence-server< 1.4.0-r8
cadence-sql-tool< 1.4.0-r8
cadvisor< 0.56.2-r15
cadvisor-fips< 0.57.0-r1

Show all 198

Alpine2 products

go≥ 1.26.0, < 1.25.9-r0 | ≥ 1.26.0, < 1.26.2-r0
rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 3826

References

38 links

go.dev/cl/763768ARTICLEREPORTWEBFIXRelease Notes
go.dev/issue/78335ARTICLEREPORTWEBIssue Tracking
groups.google.com/g/golang-announce/c/0uYbvbPZRWUARTICLEREPORTWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2026-4871AdvisoryREPORTWEBVendor Advisory
access.redhat.com/security/cve/CVE-2026-27140VDB EntryX Refsource REDHATREPORTAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2456341Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27140.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:16024Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10217Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10704Vendor AdvisoryX Refsource REDHATAdvisory

Show all 38 references

access.redhat.com/errata/RHSA-2026:16698Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:16697Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:16694Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:16494Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:16498Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:16497Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:16021Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10219Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:56854Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34099Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:25182Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:23246Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:57408Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:57545Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16494.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2026-27140AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-27140Advisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16497.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16498.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16694.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16697.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16698.jsonAdvisory
ubuntu.com/security/CVE-2026-27140REPORT
security-tracker.debian.org/tracker/CVE-2026-27140Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27140.jsonAdvisory
security.alpinelinux.org/vuln/CVE-2026-27140Advisory