CVE-2026-56865
CVE
Low
False Positivex/mod/sumdb/tlog: Transparency Log Tile Verification Bypass via Malicious GOPROXY
This advisory does not affect KrakenD
The vulnerable code path only runs inside the
go command line tool (cmd/go) when
resolving dependencies against a GOPROXY/GOSUMDB during go mod tidy, go get, or
go build. KrakenD’s compiled binary never invokes the Go toolchain or fetches
modules at runtime, so the transparency log verification logic in x/mod/sumdb/tlog
is never reached in a running deployment.Component
Go extended library (x/mod/sumdb/tlog)
Disclosed
Aug 14, 2026
Description
A malicious GOPROXY could forge up to two sumdb transparency log tiles, allowing a
requested module to bypass the GOSUMDB checksum check and persist attacker-controlled
module content into a local Go module cache. The flaw lives in
golang.org/x/mod/sumdb/tlog, the library go mod and go get use to verify
tile-based transparency logs during module downloads. The fix requires every tile to
be verified against its parent tile before being trusted.
This does not affect KrakenD, which never fetches or verifies Go modules at runtime.