CVE-2026-105218 go-pay CVE debrief

Who should care

Defenders responsible for payment processing systems that use the gopay package should be aware of this vulnerability and take steps to mitigate it. This includes verifying the versions of gopay in use and upgrading to version 1.5.119 or later.

Why it matters

CVE-2026-105218 is a critical vulnerability in the gopay package that allows man-in-the-middle attackers to impersonate payment provider APIs, potentially leading to the exposure of sensitive data and modification of payment responses. Defenders responsible for payment processing systems should verify the versions of gopay in use and upgrade to version 1.5.119 or later to mitigate this vulnerability.

• Potential exposure of merchant credentials, signatures, and transaction data
• Potential modification of payment, refund, and order query responses
• Need to verify the authenticity of payment provider APIs
• Priority to upgrade to version 1.5.119 or later

Technical summary

The gopay package before version 1.5.119 disables TLS certificate verification in the defaultClient() function in pkg/xhttp/client.go. This allows man-in-the-middle attackers to impersonate payment provider APIs, potentially leading to the exposure of merchant credentials, signatures, and transaction data, as well as the modification of payment, refund, and order query responses. Defenders should prioritize verifying the versions of gopay in use and upgrading to version 1.5.119 or later to mitigate this vulnerability. Additionally, defenders should monitor for any suspicious activity related to payment processing and verify the authenticity of payment provider APIs. The evidence for this vulnerability comes

Defensive priority

Defenders should prioritize verifying the versions of gopay in use and upgrading to version 1.5.119 or later to mitigate this vulnerability. Additionally, defenders should monitor for any suspicious activity related to payment processing and verify the authenticity of payment provider APIs.

Recommended defensive actions

• Verify the versions of gopay in use and upgrade to version 1.5.119 or later
• Monitor for suspicious activity related to payment processing
• Verify the authenticity of payment provider APIs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this vulnerability comes from the CVE Program record, the NVD vulnerability detail page, and source references provided by [email protected]. The vulnerability is caused by the disabling of TLS certificate verification in the defaultClient() function in pkg/xhttp/client.go.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.