CLEANSTART-2026-MP78954 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

🗓️ 30 Sep 2026 20:20:08Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Malicious GOPROXY bypasses GOSUMDB check to persist attacker-controlled module content.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Vulnerability in golang.org/x/mod bundled with IBM Fusion and IBM Fusion HCI	2 Oct 202618:50	–	ibm
attackerkb	CVE-2026-56865	13 Aug 202621:58	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-2114)	31 Aug 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)	31 Aug 202600:00	–	nessus
Tenable Nessus	Fedora 46 : golang-x-mod (2026-f84c399b38)	25 Sep 202600:00	–	nessus
Tenable Nessus	Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities	14 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:21592-1)	21 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21593-1)	21 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)	1 Sep 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21705-1)	1 Sep 202600:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MP78954.json
osv	www.osv.dev/vulnerability/CVE-2026-56865
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56865

01 Oct 2026 03:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.4

EPSS0.00129

Go GOPROXY GOSUMDB module cache content forgery