CVE-2024-45340: Go Toolchain Cmd/go

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.

Affected products

• Go Toolchain Cmd/go: from 1.24.0-0, before 1.24.0-rc.2 (fixed in 1.24.0-rc.2)

Published 2025-01-28. Last modified 2026-06-17.