SWIG cgo filename execution in Go cmd/go <1.26.2
CVE-2026-27140 Published on April 8, 2026

Code execution vulnerability in SWIG code generation in cmd/go
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

NVD

Vulnerability Analysis

CVE-2026-27140 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

Improper Restriction of Names for Files and Other Resources

The application constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name. This may produce resultant weaknesses. For instance, if the names of these resources contain scripting characters, it is possible that a script may get executed in the client's browser if the application ever displays the name of the resource on a dynamically generated web page. Alternately, if the resources are consumed by some application parser, a specially crafted name can exploit some vulnerability internal to the parser, potentially resulting in execution of arbitrary code on the server machine. The problems will vary based on the context of usage of such malformed resource names and whether vulnerabilities are present in or assumptions are made by the targeted technology that would make code execution possible.

Products Associated with CVE-2026-27140

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-27140 are published in these products:

GoLang Go

Red Hat Enterprise Linux Eus

Red Hat Enterprise Linux (RHEL)

Red Hat Rhel Aus

Red Hat Rhel Eus Long Life

Red Hat Rhel E4s

Red Hat Rhel Tus

Red Hat Rhel Eus

Red Hat Openshift

Red Hat Container Native Virtualization

Red Hat Service Mesh

Red Hat Hummingbird

Affected Versions

Go toolchain cmd/go:

Before 1.25.9 is affected.
Version 1.26.0-0 and below 1.26.2 is affected.

Red Hat Enterprise Linux 10:

Version 0:1.25.9-3.el10_1 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:1.25.9-1.el10_0 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020260422204008.a3795dee and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 8040020260505161557.5081a262 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 8040020260505161557.5081a262 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 8060020260505152018.97d7f71f and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 8060020260505152018.97d7f71f and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 8060020260505152018.97d7f71f and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 8080020260506150958.6b4b45d8 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 8080020260506150958.6b4b45d8 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:1.25.9-1.el9_7 and below * is unaffected.

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:

Version 0:1.17.13-12.el9_0 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:1.19.13-25.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Extended Update Support:

Version 0:1.21.13-16.el9_4 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:1.25.9-1.el9_6 and below * is unaffected.

Red Hat OpenShift Container Platform 4.17:

Version 1782184924 and below * is unaffected.

Red Hat OpenShift Container Platform 4.18:

Version 1780978272 and below * is unaffected.