A shared CI runner inherits the trust of everything it builds. Check its Go toolchain before allowing untrusted builds to run with credentials.
Go released 1.26.11 and 1.27.4 on November 10. Microsoft added Azure Linux 3.0 rows on November 13 from 01:02 through 01:07 UTC. The build-time issues are CVE-2026-97033, CVE-2026-97034, CVE-2026-97035, CVE-2026-97036, CVE-2026-97037, CVE-2026-97038, CVE-2026-97039, CVE-2026-97040, CVE-2026-97041, CVE-2026-97042 and CVE-2026-97043. They concern building untrusted Go code or build inputs, with exact prerequisites varying by CVE and platform.
MSRC lists golang 1.26.10-1 and 1.27.3-1, python-tensorboard 2.16.2-6 and tensorflow 2.16.1-11 for all eleven. It also lists gcc 13.2.0-7 for CVE-2026-97033 through CVE-2026-97040 and CVE-2026-97043. Microsoft rates the TensorBoard row for CVE-2026-97033 Critical at CVSS 3.1 9.8. The other rows for that CVE are Important at 8.1. The remaining CVEs span Moderate to Important and CVSS 3.1 5.3–8.8. The reviewed sources supply no confirmed exploitation, KEV listing, or complete Azure Linux affected ranges.
Suggested MSP priority. Expedite shared runners and any build service that compiles untrusted contributions. Check the actual toolchain, dependencies and image digest inside a job. Isolate untrusted builds from privileged runners and shared credentials. Where supported, use the fixed upstream Go release for the deployed branch. Microsoft merged source changes for Azure Linux golang 1.26.11-1 and 1.27.4-1, but production RPMs and fixes for the other mapped packages remain unverified. Rebuild the image, verify the running toolchain and package inventory, then retest representative builds.
Last verified November 13, 2026 UTC. MSRC November CVRF · Go release history · Azure Linux Go 1.26 change · Azure Linux Go 1.27 change.