[aikido-autofix]

Upgrade Go to fix certificate verification bypass allowing HTTPS server impersonation via compromised eMudhra intermediate CA keys.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-934590	HIGH	[go] certificate verification did not reject the known compromised eMudhra intermediate public keys. An attacker able to intercept a connection can use a compromised eMudhra intermediate CA key to impersonate an HTTPS server and read or modify traffic.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-21568

🤖 Remediation details

Security fix: raises the Go version in lib/agent/go.mod from 1.27.2 to 1.27.3. The vulnerable package is go (the Go toolchain/language version), and 1.27.3 is the patched release for AIKIDO-2026-934590. Only the lib/agent module changed.

go

go was on 1.27.2, which is in the affected range (>=1.27.0 <=1.27.2). The fix was go get go@1.27.3 in lib/agent, then go mod tidy. 1.27.3 is the lowest patched version on the 1.27 line. The go directive moved to 1.27.3, and the explicit toolchain go1.27.2 line was removed. No other module versions changed. lib/request-processor does not depend on lib/agent, and there is no go.work, so nothing else needed tidying or syncing.

go build ./... in lib/agent failed before the change and fails the same way after it. The errors are an unresolved main/ipc/protos import in aikido_types/events.go and a parse error in api_discovery/getDataSchema.go. Neither is related to this update, so neither was addressed.

Version changes

Package	From	To	Why updated
go (directive in lib/agent/go.mod)	1.27.2	1.27.3	Direct fix for AIKIDO-2026-934590
toolchain (directive in lib/agent/go.mod)	go1.27.2	removed	Dropped by go get go@1.27.3, since the go line now sets the toolchain

[aikido-autofix]

Closed by Aikido: the vulnerability is already resolved.