CVE-2026-56864

Description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.30%• Percentile: 23%

Techniques & Countermeasures

• CWE-347•Improper Verification of Cryptographic Signature

  The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Systems

• chainguard•aactl

  < 0.4.12-r69

• chainguard•agentbeat

  < 0

• chainguard•agentbeat-fips

  < 0

• chainguard•amazon-cloudwatch-agent

  < 0

• chainguard•amazon-eks-ami

  < 0

• chainguard•amazon-eks-ami-fips

  < 0

• chainguard•amazon-k8s-cni

  < 0

• chainguard•amazon-k8s-cni-fips

  < 0

• chainguard•apply-cve-bump

  < 0

• chainguard•argo-cd-3.3-compat

  < 0

• chainguard•argo-events

  < 0

• chainguard•argo-events-fips

  < 0

• chainguard•art

  < 0

• chainguard•atlantis

  < 0

• chainguard•atlantis-fips

  < 0

• chainguard•atlas

  < 0

• chainguard•atlas-1.0

  < 0

• chainguard•atlas-1.0-fips

  < 0

• chainguard•atlas-1.1

  < 0

• chainguard•atlas-1.1-fips

  < 0

• chainguard•atlas-1.2

  < 0

• chainguard•atlas-1.3

  < 0

• chainguard•atlas-fips

  < 0

• chainguard•atlas-fips-1.2

  < 0

• chainguard•atlas-fips-1.3

  < 0

• chainguard•aws-otel-collector-fips

  < 0

• chainguard•aws-otel-collector-healthcheck-fips

  < 0

• chainguard•azure-service-operator

  < 0

• chainguard•azurefile-csi-1.32

  < 0

• chainguard•bank-vaults-template

  < 0

• chainguard•bento

  < 0

• chainguard•bento-fips

  < 0

• chainguard•blob-csi-1.27

  < 0

• chainguard•bom

  < 0

• chainguard•boringssl-fips-static-20240407-tools

  < 0

• chainguard•buf

  < 0

• chainguard•buildah

  < 0

• chainguard•buildah-fips

  < 0

• chainguard•buildkitd

  < 0

• chainguard•buildkitd-fips

  < 0

• chainguard•buildkite-agent

  < 0

• chainguard•buildkite-agent-fips

  < 0

• chainguard•calico-felix-3.32

  < 0

• chainguard•calico-felix-fips-3.32

  < 0

• chainguard•calico-goldmane-3.31

  < 0

• chainguard•calico-key-cert-provisioner-3.31

  < 0

• chainguard•capslock

  < 0

• chainguard•cargobump

  < 0

• chainguard•cass-operator

  < 0

• chainguard•cass-operator-fips

  < 0

Showing first 50 affected entries in server-rendered view.

References (9)

• https://go.dev/issue/80745
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/815000
• https://go.dev/cl/815020
• https://pkg.go.dev/vuln/GO-2026-6180
• https://security-tracker.debian.org/tracker/CVE-2026-56864
• https://ubuntu.com/security/CVE-2026-56864
• https://www.cve.org/CVERecord?id=CVE-2026-56864
• https://github.com/golang/go/issues/80745