LiveActive security incident?Get immediate response
CVE Record

CVE-2026-27140: Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

CriticalCVSS 9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in the Go toolchain's SWIG code generation lets a malicious source file smuggle code that runs during a normal build. If a developer or build system compiles an untrusted Go project that uses SWIG, the attacker can execute commands on the build machine. The risk is highest for CI pipelines and developer laptops that build code from third-party repositories.

Executive priority

Treat as high-priority patching for engineering platforms this cycle. Business risk is elevated because a single malicious dependency or pull request could compromise build infrastructure and downstream artifacts, but no active exploitation is cited. Schedule Go toolchain upgrades on CI and developer systems and apply vendor errata on any Red Hat-based build hosts.

Technical view

Per the Go advisory and Red Hat references, cmd/go's SWIG integration can be tricked by SWIG file names containing 'cgo' combined with crafted payloads, bypassing the trust layer intended to isolate generated code. This leads to arbitrary code execution at build time. CVSS 3.1 base score is 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). CWE-501 (trust boundary violation) and CWE-641 (improper restriction of names) are cited. Fixed in Go 1.26.0 and later per the affected-versions record.

Likely exposure

Exposure concentrates on systems that build Go code which imports or vendors SWIG-based packages, particularly shared CI runners, container image build pipelines, and developer workstations that pull third-party modules. Environments that build only first-party code with vetted dependencies see lower practical exposure, but the toolchain itself must still be patched.

Exploitation context

No public sources in the bundle indicate active exploitation, and the CVE is not listed in CISA KEV. Exploitation requires the victim to build attacker-influenced Go source using a vulnerable toolchain, which the CVSS vector reflects as low complexity with required user interaction. Treat CI systems that build untrusted pull requests as the most realistic attack surface.

Researcher notes

Root cause is a trust-layer bypass in cmd/go's SWIG handling, where filenames containing 'cgo' plus crafted payloads escape the intended isolation, aligning with CWE-501 and CWE-641. Affected record lists cmd/go up to 1.26.0-0 as vulnerable; the fix lands in Go 1.26.0 per the Go issue and CL. Red Hat has shipped multiple RHSA errata (e.g., RHSA-2026:16024, 10217, 10704) covering downstream Go packages. Validate exposure by focusing on build pipelines that ingest external Go modules or SWIG-generated bindings.

Mitigation direction

  • Upgrade the Go toolchain to 1.26.0 or later across developer and CI environments.
  • Apply vendor updates such as the referenced Red Hat RHSA errata for affected Go packages.
  • Restrict CI jobs that build untrusted or fork pull-request code to ephemeral, least-privilege runners.
  • Enforce module and dependency review before builds pull new SWIG-based Go packages.
  • Monitor golang-announce and Red Hat advisories for any follow-on guidance.

Validation and detection

  • Inventory Go toolchain versions on workstations, build servers, and container base images.
  • Confirm installed Go version is 1.26.0 or later, or that vendor-backported fixes are applied.
  • Audit dependency trees for packages using SWIG (cgo-adjacent generated code) and review their sources.
  • Check CI runner images and golden templates for updated Go binaries after patching.
  • Review build logs for unexpected compiler or shell activity during recent Go builds.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-501: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-641: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-27140 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
22Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H2.36redhat-SADP
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9Critical
CVSS 3.1 vector shape for CVE-2026-27140Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
redhat-SADPcmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names
other:Red Hat severity ratingcvssV3_1
  • 2026-04-08T02:01:26.299Z: Reported to Red Hat.
  • 2026-04-08T01:06:57.893Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Go toolchaincmd/gocmd/go, 0, 1.26.0-0unaffected
Weakness

CWE details

CWE-501CWE-641

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-501 · source CWE mapping

Trust Boundary Violation

Trust Boundary Violation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-641 · source CWE mapping

Improper Restriction of Names for Files and Other Resources

Improper Restriction of Names for Files and Other Resources represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs