CVE-2026-56865 in Go
Summary
by MITRE • 08/14/2026
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability described represents a critical supply chain attack vector targeting the Go module system's integrity checking mechanisms. This flaw enabled malicious actors to compromise the gosumdb verification process by forging up to two sumdb tiles, creating a persistent backdoor for delivering attacker-controlled code to unsuspecting developers. The attack specifically targeted the Go module cache mechanism where legitimate modules could be replaced with malicious variants without detection, exploiting a fundamental weakness in the cryptographic verification chain that should have prevented such tampering.
The technical implementation of this vulnerability exploited the hierarchical structure of sumdb tiles and their parent-child relationships within the Go module verification system. Attackers could generate forged tiles that appeared valid when checked against their immediate parents but contained malicious content that would bypass subsequent verification steps. This allowed the malicious proxy to serve compromised modules that would be cached locally on developer machines, creating a persistent threat vector that could affect multiple developers and organizations simultaneously. The flaw essentially created a validation bypass where the cryptographic integrity checks were circumvented through careful manipulation of the tile verification process.
The operational impact of this vulnerability extends far beyond individual developer machines, as it undermines the fundamental security assumptions of the Go module ecosystem. When developers run go mod tidy or similar commands, they expect the module dependencies to be verified against known good checksums from the sumdb. However, this vulnerability allowed attackers to inject malicious code that would be silently accepted and cached, potentially leading to widespread compromise across development teams and organizations that rely on Go modules for their applications. The attack's persistence mechanism means that once a developer's cache is compromised, the malicious content remains undetected even after patching the proxy server itself.
The remediation process requires immediate action from affected parties through a complete cache invalidation procedure that removes all potentially compromised module data. The recommended steps involve deleting the go.sum files, go.work.sum files, and the vendor directory before running go mod tidy to rebuild the dependency tree with fresh verification. This approach ensures that any cached malicious modules are discarded and replaced with verified versions from legitimate sources. Organizations should also implement monitoring for unusual proxy behavior and consider additional verification measures such as manual checksum verification for critical dependencies.
This vulnerability aligns with several cybersecurity frameworks and attack patterns, including CWE-345 Insufficient Verification of Data Authenticity which describes the failure to properly validate data integrity. The attack pattern also corresponds to ATT&CK technique T1195.002 for Supply Chain Compromise targeting software supply chains through package repositories. The flaw demonstrates how cryptographic verification systems can be bypassed through manipulation of hierarchical data structures, representing a sophisticated approach to supply chain attacks that leverages the trust model inherent in Go's module system.
The fix implemented by the Go team addresses the core issue by enforcing strict verification of all tiles against their parent entries in the sumdb hierarchy. This change ensures that any forged or manipulated tiles will be detected during the verification process, preventing the injection of malicious content through compromised proxies. The solution reinforces the cryptographic chain of trust that should exist between each level of the sumdb structure, making it significantly harder for attackers to exploit similar vulnerabilities in the future. Organizations should monitor their Go module usage and ensure they are running patched versions of the Go toolchain to prevent exploitation of this vulnerability.
The broader implications of this attack highlight the importance of supply chain security in modern software development practices. As more organizations rely on third-party dependencies and package managers, vulnerabilities like this demonstrate how small weaknesses in cryptographic verification can lead to widespread compromise. The incident underscores the need for continuous monitoring of dependency integrity and regular cache validation procedures, as well as the importance of maintaining up-to-date toolchains that include security fixes. This vulnerability serves as a reminder that even seemingly robust verification systems can contain exploitable edge cases that require careful attention to cryptographic implementation details.