fix: disable Multipath TCP by default to mitigate CVE-2026-98432

Merged
MI
16h ago
+4-0

Go programs enable Multipath TCP (MPTCP) on listen sockets by default on Linux since Go 1.24. CVE-2026-98432 is a Linux kernel use-after-free that a published exploit reaches through an MPTCP listener to get remote code execution.

This change adds godebug multipathtcp=0 to the main module's go.mod, which follows the mitigation from the Go Security Team. All binaries built from this module stop opening MPTCP listeners by default: the control plane, the artifact CAS, the CLI and the plugins. The release pipeline needs no changes.

This is a defense-in-depth measure. The primary fix is still a patched kernel on the hosts that run Chainloop.

References:

AI disclosure: this change was made with the help of Claude Code.