CVE-2026-27140

Description

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

CVSS Metrics

• v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• v3.1•CRITICAL•Score: 9CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.66%• Percentile: 50%

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

• CWE-641•Improper Restriction of Names for Files and Other Resources

  The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.

Affected Systems

• chainguard•aactl

  < 0.4.12-r53

• chainguard•act

  < 0.2.87-r2

• chainguard•actions-runner-controller

  < 0.14.1-r0

• chainguard•actions-runner-controller-fips

  < 0.14.1-r0

• chainguard•addon-resizer

  < 1.8.23-r17

• chainguard•addon-resizer-fips

  < 1.8.23-r18

• chainguard•age

  < 1.3.1-r5

• chainguard•age-fips

  < 1.3.1-r7

• chainguard•agentbeat

  < 9.2.7-r4

• chainguard•agentbeat-fips

  < 9.2.7-r5

• chainguard•amass

  < 5.1.1-r5 | < 5.1.1-r0

• chainguard•amazon-cloudwatch-agent

  < 1.300066.1-r2

• chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard

  < 1.300066.1-r2

• chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips

  < 1.300069.0-r1

• chainguard•amazon-cloudwatch-agent-config-downloader

  < 1.300066.1-r2

• chainguard•amazon-cloudwatch-agent-config-downloader-fips

  < 1.300069.0-r1

• chainguard•amazon-cloudwatch-agent-config-translator

  < 1.300066.1-r2

• chainguard•amazon-cloudwatch-agent-config-translator-fips

  < 1.300069.0-r1

• chainguard•amazon-cloudwatch-agent-fips

  < 1.300069.0-r1

• chainguard•amazon-cloudwatch-agent-operator

  < 3.4.2-r3

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 3.4.2-r4 | < 3.3.3-r1

• chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent

  < 1.300066.1-r2

• chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips

  < 1.300069.0-r1

• chainguard•amazon-ecs-agent

  < 1.103.2-r0

• chainguard•amazon-ecs-agent-fips

  < 1.103.2-r0

• chainguard•amazon-ecs-cni-plugins

  < 2024.9.0_git20260522-r1

• chainguard•amazon-ecs-cni-plugins-fips

  < 2024.9.0_git20260306-r2

• chainguard•amazon-eks-ami

  < 20260527-r0

• chainguard•amazon-eks-ami-fips

  < 20260527-r0

• chainguard•amazon-k8s-cni

  < 1.21.1-r5 | < 1.22.1-r0

• chainguard•amazon-k8s-cni-compat

  < 1.21.1-r5

• chainguard•amazon-k8s-cni-fips

  < 1.21.1-r6

• chainguard•amazon-k8s-cni-init

  < 1.22.1-r0 | < 1.21.1-r5

• chainguard•amazon-k8s-cni-init-compat

  < 1.21.1-r5

• chainguard•amazon-k8s-cni-init-fips

  < 1.21.1-r6

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.21.1-r6

• chainguard•amazon-ssm-agent

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 3.3.4515.0-r3

• chainguard•amazon-ssm-agent-fips

  < 3.3.4515.0-r3

• chainguard•amazon-vpc-cni-plugins

  < 1.3_git20260307-r4

• chainguard•amazon-vpc-cni-plugins-fips

  < 1.3_git20260307-r2

• chainguard•apache-beam-java-11-sdk

  < 2.73.0-r0

• chainguard•apache-beam-java-17-sdk

  < 2.73.0-r0

• chainguard•apache-beam-java-21-sdk

  < 2.73.0-r0

• chainguard•apache-beam-python-3.11-sdk

  < 2.73.0-r6

• chainguard•apache-beam-python-3.12-sdk

  < 2.72.0-r2

• chainguard•apache-beam-python-3.13-sdk

  < 2.73.0-r4

• chainguard•apache-exporter

  < 1.0.12-r6

• chainguard•apisix-ingress-controller

  < 2.0.1-r10

Showing first 50 affected entries in server-rendered view.

References (36)

• https://go.dev/cl/763768
• https://go.dev/issue/78335
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• https://pkg.go.dev/vuln/GO-2026-4871
• https://access.redhat.com/security/cve/CVE-2026-27140
• https://bugzilla.redhat.com/show_bug.cgi?id=2456341
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27140.json
• https://access.redhat.com/errata/RHSA-2026:16024
• https://access.redhat.com/errata/RHSA-2026:10217
• https://access.redhat.com/errata/RHSA-2026:10704
• https://access.redhat.com/errata/RHSA-2026:16698
• https://access.redhat.com/errata/RHSA-2026:16697
• https://access.redhat.com/errata/RHSA-2026:16694
• https://access.redhat.com/errata/RHSA-2026:16494
• https://access.redhat.com/errata/RHSA-2026:16498
• https://access.redhat.com/errata/RHSA-2026:16497
• https://access.redhat.com/errata/RHSA-2026:16021
• https://access.redhat.com/errata/RHSA-2026:10219
• https://access.redhat.com/errata/RHSA-2026:25182
• https://access.redhat.com/errata/RHSA-2026:23246
• https://access.redhat.com/errata/RHSA-2026:34099
• https://security-tracker.debian.org/tracker/CVE-2026-27140
• https://access.redhat.com/security/updates/classification/#important
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16494.json
• https://www.cve.org/CVERecord?id=CVE-2026-27140
• https://nvd.nist.gov/vuln/detail/CVE-2026-27140
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16497.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16498.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16694.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16697.json
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16698.json
• https://access.redhat.com/errata/RHSA-2026:57545
• https://access.redhat.com/errata/RHSA-2026:56854
• https://access.redhat.com/errata/RHSA-2026:57408
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27140.json