GitHub Actions · Go · Security · Checked November 5, 2026

govulncheck in GitHub Actions: "Vulnerability #1: GO-2026-6809" (CVE-2026-111943) in crypto/x509, fixed in Go 1.26.10 and 1.27.3

GO-2026-6809 (CVE-2026-111943) was published on October 21, 2026. It is Go's answer to the compromised eMudhra intermediate CAs: crypto/x509 now refuses those intermediates in Verify, even where the system's trust store is old. Every Go release before 1.26.10, and 1.27.0 to 1.27.2, lacks that list (GO-2026-6809). Your code did not change; the vulnerability database did, so a scan of the same commit that passed the day before now fails, on main's scheduled runs and on every open pull request. The fix is to build and scan with Go 1.26.10 or 1.27.3 or later.

What it looks like

govulncheck (from calciotto #29):

Vulnerability #1: GO-2026-6809
    Distrust compromised intermediate certificates in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-6809
  Standard library
    Found in: crypto/x509@go1.26.9
    Fixed in: crypto/x509@go1.26.10
    Example traces found:
      #1: cmd/perfsetup/main.go:118:12: perfsetup.main calls fmt.Printf, which eventually calls x509.Certificate.Verify

Your code is affected by 1 vulnerability from the Go standard library.
...
exit status 3

govulncheck exits with 3 when it finds a vulnerability your code calls, which fails the step. Almost any program that makes a TLS connection calls Verify: the traces run through net/http, crypto/tls or, as above, a path govulncheck found from fmt. Trivy reports the same thing against Go binaries in an image, as package stdlib, severity HIGH, with fixed versions 1.26.10 and 1.27.3.

Where the workflow decides the Go version

The version that counts is the Go that builds or scans, so the fix goes wherever that version comes from:

• actions/setup-go with go-version-file: go.mod uses the toolchain line if there is one, otherwise the go line (setup-go). Raise it: go 1.26.10 (or toolchain go1.26.10), or 1.27.3 on 1.27. Many of the fixes in the reports are this one line.
• A pinned go-version: '1.26.9' in a workflow, a .go-version or .tool-versions file, or a pre-commit setting: raise each one. A range such as '1.26' or '1.26.x' takes the newest version already on the runner first; add check-latest: true so it fetches 1.26.10 if the image has not caught up.
• golang/govulncheck-action sets up Go itself, with go-version-input defaulting to stable and check-latest to true. If you also pass go-version-file, setup-go gives go-version priority, so the file is used only when you set go-version-input: ''; then the file's version is the one to raise.
• Docker builds: FROM golang:1.26.9 or golang:1.27.2 builds the binary with the old library whatever the workflow installs. Move the build stage to golang:1.26.10 or golang:1.27.3, and rebuild and republish images and release binaries, because a binary keeps the library it was built with.

Binaries you ship but do not build, such as a third-party tool copied into an image, are fixed only by an upstream release built with a fixed Go. Until then, a .trivyignore entry with the reason keeps the scan useful for everything else.

Telling it apart

• go: go.mod requires go >= 1.26.10 (running go 1.26.9; GOTOOLCHAIN=local) after the bump: the job sets GOTOOLCHAIN=local, so Go does not fetch the newer toolchain. Install the new version in the job instead (Go 1.24 leaves the runner images covers GOTOOLCHAIN and go-version-file).
• A scan that still fails after the bump with a different ID is a different advisory; read its "Found in" line the same way.
• curl, git, Python, Node.js and Java do not use Go's list. For them, see which runners still trust the eMudhra intermediates.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, so a scheduled scan that turned red on main stands out, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Go is a trademark of Google LLC; Docker is a trademark of Docker, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by any of them.

More: The eMudhra CA compromise on the runners · Go 1.24 leaves the runner images · GitHub Actions plugins for IntelliJ IDEA compared · 日本語