Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure Golang 1.26.7 can deliver undetected malicious code
published 2 months ago
Summary
The Go programming environment version 1.26.7 used in Azure can be tricked into downloading harmful code that bypasses its built‑in safety checks. This means an attacker could supply malicious modules without the system noticing. To protect yourself, clean up the dependency files (go.sum, go.work.sum, vendor folder) and then run the module tidy command to verify all packages again.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | golang | <= 1.26.7-1 |
Original advisory text
CVE-2026-56864 affecting package golang 1.26.7-1
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
References
Timeline
Published13 Aug 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-96671 · OSV
Track software like this
Free during beta