CVE-2026-27140
Code execution vulnerability in SWIG code generation in cmd/go
HIGH
8.8
CVSS Score
Published: April 8, 2026 at 01:06 AM UTC
Updated: September 10, 2026 at 01:17 PM UTC
5 products affected across 3 vendorsGoEnterprise LinuxOpenShift Container Platform
Using cmd/go by Go toolchain?
Get instant alerts when new vulnerabilities affect cmd/go - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 0.7%
SSVC
No known exploit
Description
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 1.25.91.26.0 ≤ v < 1.26.2
Affected range stops below 1.25.9, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.26.2, so it looks safe — our inference, not a vendor statement
60%
Affected range stops below 1.25.9, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.26.2, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 0:1.17.13-12.el9_0 (unaffected)
Vendor states this is fixed in 0:1.19.13-25.el9_2 (unaffected)
Vendor states this is fixed in 0:1.21.13-16.el9_4 (unaffected)
Vendor states this is fixed in 0:1.25.9-1.el10_0 (unaffected)
Vendor states this is fixed in 0:1.25.9-1.el9_6 (unaffected)
Vendor states this is fixed in 0:1.25.9-1.el9_7 (unaffected)
Vendor states this is fixed in 0:1.25.9-3.el10_1 (unaffected)
Vendor states this is fixed in 8040020260505161557.5081a262 (unaffected)
Vendor states this is fixed in 8060020260505152018.97d7f71f (unaffected)
Vendor states this is fixed in 8080020260506150958.6b4b45d8 (unaffected)
Vendor states this is fixed in 8100020260422204008.a3795dee (unaffected)
60%
Vendor states this is fixed in 1779779751 (unaffected)
Vendor states this is fixed in 1780040095 (unaffected)
Vendor states this is fixed in 1780040098 (unaffected)
Vendor states this is fixed in 1780040104 (unaffected)
Vendor states this is fixed in 1780040106 (unaffected)
Vendor states this is fixed in 1780040115 (unaffected)
Vendor states this is fixed in 1780040117 (unaffected)
Vendor states this is fixed in 1780040119 (unaffected)
Vendor states this is fixed in 1780040125 (unaffected)
Vendor states this is fixed in 1780040126 (unaffected)
Vendor states this is fixed in 1780040131 (unaffected)
Vendor states this is fixed in 1780040138 (unaffected)
Vendor states this is fixed in 1780040139 (unaffected)
Vendor states this is fixed in 1780040140 (unaffected)
Vendor states this is fixed in 1780040143 (unaffected)
Vendor states this is fixed in 1780040144 (unaffected)
Vendor states this is fixed in 1780040160 (unaffected)
Vendor states this is fixed in 1780040161 (unaffected)
Vendor states this is fixed in 1780040173 (unaffected)
Vendor states this is fixed in 1780040249 (unaffected)
Vendor states this is fixed in 1780040250 (unaffected)
Vendor states this is fixed in 1780040278 (unaffected)
Vendor states this is fixed in 1780040283 (unaffected)
Vendor states this is fixed in 1780040315 (unaffected)
Vendor states this is fixed in 1780040338 (unaffected)
Vendor states this is fixed in 1780040359 (unaffected)
Vendor states this is fixed in 1780040365 (unaffected)
Vendor states this is fixed in 1780040374 (unaffected)
Vendor states this is fixed in 1780040386 (unaffected)
Vendor states this is fixed in 1780040410 (unaffected)
Vendor states this is fixed in 1780040430 (unaffected)
Vendor states this is fixed in 1780040431 (unaffected)
Vendor states this is fixed in 1780040455 (unaffected)
Vendor states this is fixed in 1780040459 (unaffected)
Vendor states this is fixed in 1780040462 (unaffected)
Vendor states this is fixed in 1780040470 (unaffected)
Vendor states this is fixed in 1780040471 (unaffected)
Vendor states this is fixed in 1780040474 (unaffected)
Vendor states this is fixed in 1780040502 (unaffected)
Vendor states this is fixed in 1780040511 (unaffected)
Vendor states this is fixed in 1780040551 (unaffected)
Vendor states this is fixed in 1780040569 (unaffected)
Vendor states this is fixed in 1780040576 (unaffected)
Vendor states this is fixed in 1780040612 (unaffected)
Vendor states this is fixed in 1780040715 (unaffected)
Vendor states this is fixed in 1780040812 (unaffected)
Vendor states this is fixed in 1780040850 (unaffected)
Vendor states this is fixed in 1780040876 (unaffected)
Vendor states this is fixed in 1780040877 (unaffected)
Vendor states this is fixed in 1780040920 (unaffected)
Vendor states this is fixed in 1780040998 (unaffected)
Vendor states this is fixed in 1780041003 (unaffected)
Vendor states this is fixed in 1780041035 (unaffected)
Vendor states this is fixed in 1780041069 (unaffected)
Vendor states this is fixed in 1780041137 (unaffected)
Vendor states this is fixed in 1780041147 (unaffected)
Vendor states this is fixed in 1780041162 (unaffected)
Vendor states this is fixed in 1780041206 (unaffected)
Vendor states this is fixed in 1780041224 (unaffected)
Vendor states this is fixed in 1780041279 (unaffected)
Vendor states this is fixed in 1780041386 (unaffected)
Vendor states this is fixed in 1780041460 (unaffected)
Vendor states this is fixed in 1780041461 (unaffected)
Vendor states this is fixed in 1780041462 (unaffected)
Vendor states this is fixed in 1780041501 (unaffected)
Vendor states this is fixed in 1780041508 (unaffected)
Vendor states this is fixed in 1780041614 (unaffected)
Vendor states this is fixed in 1780041673 (unaffected)
Vendor states this is fixed in 1780041696 (unaffected)
Vendor states this is fixed in 1780041732 (unaffected)
Vendor states this is fixed in 1780041753 (unaffected)
Vendor states this is fixed in 1780041754 (unaffected)
Vendor states this is fixed in 1780041774 (unaffected)
Vendor states this is fixed in 1780041782 (unaffected)
Vendor states this is fixed in 1780041802 (unaffected)
Vendor states this is fixed in 1780041841 (unaffected)
Vendor states this is fixed in 1780041847 (unaffected)
Vendor states this is fixed in 1780041860 (unaffected)
Vendor states this is fixed in 1780041886 (unaffected)
Vendor states this is fixed in 1780041901 (unaffected)
Vendor states this is fixed in 1780041921 (unaffected)
Vendor states this is fixed in 1780042119 (unaffected)
Vendor states this is fixed in 1780042236 (unaffected)
Vendor states this is fixed in 1780042237 (unaffected)
Vendor states this is fixed in 1780042252 (unaffected)
Vendor states this is fixed in 1780042274 (unaffected)
Vendor states this is fixed in 1780042508 (unaffected)
Vendor states this is fixed in 1780042603 (unaffected)
Vendor states this is fixed in 1780042895 (unaffected)
Vendor states this is fixed in 1780043063 (unaffected)
Vendor states this is fixed in 1780043143 (unaffected)
Vendor states this is fixed in 1780043151 (unaffected)
Vendor states this is fixed in 1780043162 (unaffected)
Vendor states this is fixed in 1780043164 (unaffected)
Vendor states this is fixed in 1780043165 (unaffected)
Vendor states this is fixed in 1780043209 (unaffected)
Vendor states this is fixed in 1780043216 (unaffected)
Vendor states this is fixed in 1780043267 (unaffected)
Vendor states this is fixed in 1780043300 (unaffected)
Vendor states this is fixed in 1780043304 (unaffected)
Vendor states this is fixed in 1780043338 (unaffected)
Vendor states this is fixed in 1780043389 (unaffected)
Vendor states this is fixed in 1780043417 (unaffected)
Vendor states this is fixed in 1780043476 (unaffected)
Vendor states this is fixed in 1780043484 (unaffected)
Vendor states this is fixed in 1780043588 (unaffected)
Vendor states this is fixed in 1780043624 (unaffected)
Vendor states this is fixed in 1780043688 (unaffected)
Vendor states this is fixed in 1780043742 (unaffected)
Vendor states this is fixed in 1780043773 (unaffected)
Vendor states this is fixed in 1780043779 (unaffected)
Vendor states this is fixed in 1780043788 (unaffected)
Vendor states this is fixed in 1780043821 (unaffected)
Vendor states this is fixed in 1780043827 (unaffected)
Vendor states this is fixed in 1780043838 (unaffected)
Vendor states this is fixed in 1780043841 (unaffected)
Vendor states this is fixed in 1780043953 (unaffected)
Vendor states this is fixed in 1780043978 (unaffected)
Vendor states this is fixed in 1780044088 (unaffected)
Vendor states this is fixed in 1780044248 (unaffected)
Vendor states this is fixed in 1780044330 (unaffected)
Vendor states this is fixed in 1780044334 (unaffected)
Vendor states this is fixed in 1780044358 (unaffected)
Vendor states this is fixed in 1780044360 (unaffected)
Vendor states this is fixed in 1780044383 (unaffected)
Vendor states this is fixed in 1780044407 (unaffected)
Vendor states this is fixed in 1780044416 (unaffected)
Vendor states this is fixed in 1780044427 (unaffected)
Vendor states this is fixed in 1780044523 (unaffected)
Vendor states this is fixed in 1780044576 (unaffected)
Vendor states this is fixed in 1780044606 (unaffected)
Vendor states this is fixed in 1780044651 (unaffected)
Vendor states this is fixed in 1780044670 (unaffected)
Vendor states this is fixed in 1780044673 (unaffected)
Vendor states this is fixed in 1780044692 (unaffected)
Vendor states this is fixed in 1780044702 (unaffected)
Vendor states this is fixed in 1780044706 (unaffected)
Vendor states this is fixed in 1780044865 (unaffected)
Vendor states this is fixed in 1780044883 (unaffected)
Vendor states this is fixed in 1780044910 (unaffected)
Vendor states this is fixed in 1780044940 (unaffected)
Vendor states this is fixed in 1780044985 (unaffected)
Vendor states this is fixed in 1780044994 (unaffected)
Vendor states this is fixed in 1780045015 (unaffected)
Vendor states this is fixed in 1780045024 (unaffected)
Vendor states this is fixed in 1780045070 (unaffected)
Vendor states this is fixed in 1780046352 (unaffected)
Vendor states this is fixed in 1780046879 (unaffected)
Vendor states this is fixed in 1780056937 (unaffected)
Vendor states this is fixed in 1780059431 (unaffected)
Vendor states this is fixed in 1780060002 (unaffected)
Vendor states this is fixed in 1780060168 (unaffected)
Vendor states this is fixed in 1780077014 (unaffected)
Vendor states this is fixed in 1780077151 (unaffected)
Vendor states this is fixed in 1780293328 (unaffected)
Vendor states this is fixed in 1780320077 (unaffected)
Vendor states this is fixed in 1780365279 (unaffected)
Vendor states this is fixed in 1780365284 (unaffected)
Vendor states this is fixed in 1780365324 (unaffected)
Vendor states this is fixed in 1780365421 (unaffected)
Vendor states this is fixed in 1780365576 (unaffected)
Vendor states this is fixed in 1780384569 (unaffected)
Vendor states this is fixed in 1780454976 (unaffected)
Vendor states this is fixed in 1780456062 (unaffected)
Vendor states this is fixed in 1780456268 (unaffected)
Vendor states this is fixed in 1780462410 (unaffected)
Vendor states this is fixed in 1780462456 (unaffected)
Vendor states this is fixed in 1780462550 (unaffected)
Vendor states this is fixed in 1780462567 (unaffected)
Vendor states this is fixed in 1780462866 (unaffected)
Vendor states this is fixed in 1780465170 (unaffected)
Vendor states this is fixed in 1780466471 (unaffected)
Vendor states this is fixed in 1780503846 (unaffected)
Vendor states this is fixed in 1780503869 (unaffected)
Vendor states this is fixed in 1780978272 (unaffected)
Vendor states this is fixed in 1782184924 (unaffected)
Vendor states this is fixed in 1786762982 (unaffected)
Vendor states this is fixed in 1786788012 (unaffected)
Vendor states this is fixed in 1787059394 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (24)
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10217Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10219Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10704Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:16021SSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
8.8HIGHCISA-ADP
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-863CWE-641
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card