Junglewise Threat Intelligence

CVE-2026-33487: russellhaering goxmldsig signature bypass in validateSignature

CVE-2026-33487 · Severity: high · CVSS 7.5 · Published 2026-03-26

Technologies: github.com/russellhaering/goxmldsig (Go), Red Hat Multicluster Global Hub. Vendors: Red Hat, Go.

Executive brief

The goxmldsig library, used for processing XML digital signatures in Go-based applications, contains a flaw that can allow attackers to bypass security checks. By exploiting a coding error in how the library validates signatures, an attacker could modify the content of a signed document without invalidating the signature. This could lead to unauthorized data modification or the bypass of integrity protections in systems that rely on this library for secure communications.

Technical details

A loop variable capture vulnerability exists in the `validateSignature` function within `validate.go`. When compiled with Go versions prior to 1.22 (or using older `go.mod` settings), the code takes the address of the loop iteration variable `_ref` instead of its value. Because Go reused the same memory address for loop variables in older versions, the `ref` pointer consistently points to the final element in the `SignedInfo.References` slice regardless of which element actually matched the ID. An attacker can exploit this by providing multiple references, allowing them to substitute malicious content for a legitimate signed element. The issue is resolved in version 1.6.0 by using the slice index to reference elements directly.

Affected products

  • russellhaering goxmldsig <= v1.5.0
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat OpenShift GitOps 1.18, 1.19
  • Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2

Timeline

  • 2026-03-18: advisory: GitHub Advisory GHSA-479m-364c-43vc published
  • 2026-03-26: disclosed: CVE-2026-33487 published to NVD
  • 2026-05-04: patched: Red Hat released security updates for Advanced Cluster Management

References

Related threats