CVE-2026-94444
HIGH · 7.8 EPSS 0.1%Vendor patched; no PoC, no KEV, no active exploitation signal; pure advisory chatter.
What: Go module proxy validation bypass allowing malicious golang.org/fips140 module substitution via spoofed GOMODPROXY; affects Go toolchain users (CVSS 7.8 HIGH).
Why it matters: Google patched this in Go v1.15.9 (Oct 21, 2026) by hardening ziphash verification for bundled modules. Not KEV-listed yet; no public PoC or in-the-wild exploitation reported. Social chatter is vendor security advisory noise—Google and Apigee released coordinated patch notices bundling this with many other CVEs.
Where it's seen: Apigee hybrid component security advisories (Oct 2026) listing CVE-2026-94444 among batches of fixes; no independent researcher discussion, no threat intelligence signals, no defender triage questions.
RISK: HIGH — Supply-chain attack vector on Go builds; requires malicious proxy + project config but impacts reproducibility.
Description
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
CVSS 3.1 breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Attack vector
- Local
- Complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High