A cryptographic signature verification flaw in the Go toolchain allows malicious module proxies to bypass checksum validation and execute altered software.

This vulnerability involves improper verification of cryptographic signatures under CWE-347, affecting unauthenticated users utilizing untrusted module proxies or checksum databases.

A successful exploit allows an attacker to compromise the integrity of Go toolchain downloads, potentially leading to remote code execution and total system compromise within development and build pipelines. The CVSS score of 7.5 reflects a high severity threat that requires prompt administrative attention to prevent supply chain contamination.

Immediate Action: Upgrade the base Go toolchain to version 1.25.10 or 1.26.3, or later, as setting GOTOOLCHAIN to a fixed version is insufficient for mitigation.

Proactive Monitoring: Monitor build environments and dependency management logs for anomalous module proxy requests or unexpected toolchain downloads.

Compensating Controls: Enforce strict organizational policies to restrict development environments to trusted, internal module proxies and verified checksum databases.

Public Exploit Available: No (false / unknown)

Given the high severity score and the potential for severe supply chain impact, development and security teams must prioritize upgrading the Go toolchain across all build systems and developer workstations. Immediate patching ensures cryptographic verification functions correctly and blocks untrusted toolchain executions.