CVE-2026-42503: gopls Vulnerability Exposes Dev Environments to RCE

The National Vulnerability Database has issued an advisory for CVE-2026-42503, a high-severity vulnerability (CVSS 8.8) affecting gopls, the Go language server. By default, gopls communicates via pipe, but it supports -port and -listen flags for debugging. If -listen is configured without an explicit host (e.g., :8080) or -port is used, gopls will inadvertently bind to 0.0.0.0.

This misconfiguration allows gopls to listen on all network interfaces, making it accessible to external parties. A malicious actor on the same network can exploit this to execute arbitrary code via the gopls process. The National Vulnerability Database categorizes this under CWE-1327, indicating an improper handling of network binding.

This is not a theoretical flaw; it’s a critical oversight for development environments. Any developer running gopls with these flags, even for debugging, could be exposing their system to network-based RCE. The attacker’s calculus here is straightforward: scan for open gopls ports, connect, and execute. It’s a low-effort, high-impact attack vector within a trusted network segment.