CVE-2026-94447
HIGH · 7.8 EPSS 0.1%Vendor patched; no PoC public, KEV-unlisted, chatter is vendor advisory noise, not exploitation signal.
What: Go toolchain checksum bypass in GOMODPROXY scenario—attacker can supply malicious golang.org/toolchain go.sum entry and intercept canonical checksum validation (CVSS 7.8 HIGH).
Why it matters: NVD describes a real supply-chain attack vector patched in Go, but social chatter conflates CVE-2026-94447 with unrelated Apigee hybrid security fixes released October 21. The CVE appears bundled in vendor patch lists but lacks dedicated PoC, KEV listing, or active exploitation signal. Noise drowns substantive Go community discussion.
Where it's seen: Apigee component release notes recycling CVE identifiers in bulk patches; no focused Go security advisory, researcher PoC, or defender triage visible in top posts.
RISK: MODERATE — Real vuln in supply-chain tooling; impact limited to malicious project + proxy combo scenario.
Description
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
CVSS 3.1 breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Attack vector
- Local
- Complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High