CVE-2026-33487: russellhaering goxmldsig signature bypass in validateSignature

CVE-2026-33487 · Severity: high · CVSS 7.5 · Published 2026-03-26

The goxmldsig library, used for processing XML digital signatures in Go-based applications, contains a flaw that can allow attackers to bypass security checks. By exploiting a coding error in how the library validates signatures, an attacker could modify the content of a signed document without invalidating the signature. This could lead to unauthorized data modification or the bypass of integrity protections in systems that rely on this library for secure communications.

Technologies: github.com/russellhaering/goxmldsig (Go), Red Hat Multicluster Global Hub. Vendors: Go, Red Hat.

Quick answers

Is CVE-2026-33487 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33487 being exploited in the wild.
How severe is CVE-2026-33487?
High severity, with a CVSS score of 7.5, published 26 March 2026.
Which products and versions are affected?
github.com/russellhaering/goxmldsig (Go) SEMVER:introduced=0,fixed=1.6.0; Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2.
Is there a fix for CVE-2026-33487?
Yes. github.com/russellhaering/goxmldsig (Go): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33487 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33487?
Check whether you run github.com/russellhaering/goxmldsig (Go), Goxmldsig Project Goxmldsig or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/russellhaering/goxmldsig (Go): upgrade to 1.6.0 or later
    go get github.com/russellhaering/goxmldsig@v1.6.0

Technical details

A loop variable capture vulnerability exists in the `validateSignature` function within `validate.go`. When compiled with Go versions prior to 1.22 (or using older `go.mod` settings), the code takes the address of the loop iteration variable `_ref` instead of its value. Because Go reused the same memory address for loop variables in older versions, the `ref` pointer consistently points to the final element in the `SignedInfo.References` slice regardless of which element actually matched the ID. An attacker can exploit this by providing multiple references, allowing them to substitute malicious content for a legitimate signed element. The issue is resolved in version 1.6.0 by using the slice index to reference elements directly.

Affected products

  • russellhaering goxmldsig <= v1.5.0
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat OpenShift GitOps 1.18, 1.19
  • Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2

Identifiers

  • CVE-2026-33487
  • GHSA-479m-364c-43vc
  • GO-2026-4753

Timeline

  • 2026-03-18: advisory: GitHub Advisory GHSA-479m-364c-43vc published
  • 2026-03-26: disclosed: CVE-2026-33487 published to NVD
  • 2026-05-04: patched: Red Hat released security updates for Advanced Cluster Management

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.