x/mod/sumdb/tlog: Transparency Log Tile Verification Bypass via Malicious GOPROXY

This CVE does not affect KrakenD

The vulnerable code path only runs inside the go command line tool (cmd/go) when resolving dependencies against a GOPROXY/GOSUMDB during go mod tidy, go get, or go build. KrakenD’s compiled binary never invokes the Go toolchain or fetches modules at runtime, so the transparency log verification logic in x/mod/sumdb/tlog is never reached in a running deployment.

Addressed through routine dependency maintenance in CE 2.13.9 and EE 2.13.7.

Component

Go extended library (x/mod/sumdb/tlog)

Disclosed

Aug 14, 2026

Description

A malicious GOPROXY could forge up to two sumdb transparency log tiles, allowing a requested module to bypass the GOSUMDB checksum check and persist attacker-controlled module content into a local Go module cache. The flaw lives in golang.org/x/mod/sumdb/tlog, the library go mod and go get use to verify tile-based transparency logs during module downloads. The fix requires every tile to be verified against its parent tile before being trusted. This does not affect KrakenD, which never fetches or verifies Go modules at runtime.

References

View CVE-2026-56865 on NVD

Stay up to date with KrakenD releases and important updates