CVE-2026-12681: Go-Attestation Hash Injection Into Trusted Measurement Vulnerability
HIGHCVE-2026-12681 is a HIGH (CVSS 6.8) hash injection into trusted measurement vulnerability (CWE-20: Improper Input Validation) affecting Go-Attestation libraries in the Go ecosystem. The issue involves hash injection into trusted measurement list via unskipped signatureheadersize vendor bytes in parseefisignaturelist(). Remediation is available by upgrading affected packages to version 0.6.1.
CVE-2026-12681 at a Glance
Security Impact
CVSS: 6.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).
How to Fix CVE-2026-12681
To remediate this vulnerability, upgrade all affected Go-Attestation dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/google/go-attestation to 0.6.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/google/go-attestationHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-12681, inspect your project dependencies for Go-Attestation:
inspect dependencies for github.com/google/go-attestationAnalyze the terminal output to locate any version of Go-Attestation in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.6.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Go-Attestation, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-12681 Affected Go-Attestation Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/google/go-attestation
|
Go |
< 0.6.1
|
0.6.1
|
References
Frequently Asked Questions
What is CVE-2026-12681?
Which Go-Attestation versions are affected?
What version fixes CVE-2026-12681?
Is github.com/google/go-attestation affected?
What is the CVSS score of CVE-2026-12681?
What CWE is associated with CVE-2026-12681?
How can I check Go dependencies for CVE-2026-12681?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9r4w-jg96-92mv",
"modified" : "2026-08-28T20:48:40Z",
"published" : "2026-06-12T15:04:43Z",
"aliases" : [ "CVE-2026-12681" ],
"summary" : "Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()",
"details" : "## Summary\n\n`parseEfiSignatureList()` in `attest/internal/events.go` does not skip\n`SignatureHeaderSize` vendor bytes before reading `EFI_SIGNATURE_LIST`\nsignature entries, violating UEFI specification section 31.4.1.\n\n## Impact\n\nFor `hashSHA256SigGUID` lists, attacker-controlled vendor header bytes are appended directly to the trusted SHA256 hash list. A crafted TPM event log can inject arbitrary SHA256 hashes into the verifier's trusted measurement database, allowing a remote attestation verifier to accept a compromised boot state as legitimate — breaking the core integrity guarantee of remote attestation.\n\n## Root Cause\n\nAfter `binary.Read(&signatures.Header)` reads 28 bytes, `buf` points to the start of the `SignatureHeaderSize` vendor bytes. Both entry loops start at `sigOffset := 0` instead of `sigOffset := SignatureHeaderSize`, causing vendor bytes to be read as signature entries.\n\n## Affected versions\n\nAll versions through commit `f877374` (2026-05-15).\n\n## Fix\n\nPull request: https://github.com/google/go-attestation/pull/502\n\n- Add bound check: `SignatureHeaderSize` must not exceed remaining list space\n- Skip `SignatureHeaderSize` bytes before both entry loops\n- Regression test: `TestParseEfiSignatureListNonZeroSignatureHeaderSize`",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/google/go-attestation"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.6.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.6.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-12681"
}, {
"type" : "WEB",
"url" : "https://github.com/google/go-attestation/pull/502"
}, {
"type" : "WEB",
"url" : "https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/google/go-attestation"
}, {
"type" : "WEB",
"url" : "https://github.com/google/go-attestation/releases/tag/v0.6.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1285", "CWE-20" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-12T15:04:43Z",
"nvd_published_at" : "2026-06-24T02:16:28Z"
}
}